Terrorism Informatics - Knowledge Management and Data Mining for Homeland Security

TERRORISM INFORMATICS Knowledge Management and Data Mining for Homeland Security

INTEGRATED SERIES IN INFORMATION SYSTEMS Series Editors Professor Ramesh Sharda

Prof. Dr. Stefan Voß

Oklahoma State University

Universität Hamburg

Other published titles in the series: E-BUSINESS MANAGEMENT: Integration of Web Technologies with Business Models/ edited by Michael J. Shaw VIRTUAL CORPORATE UNIVERSITIES: A Matrix of Knowledge and Learning for the New Digital Dawn/ Walter R.J. Baets & Gert Van der Linden SCALABLE ENTERPRISE SYSTEMS: An Introduction to Recent Advances/ edited by Vittal Prabhu, Soundar Kumara, Manjunath Kamath LEGAL PROGRAMMING: Legal Compliance for RFID and Software Agent Ecosystems in Retail Processes and Beyond/ Brian Subirana and Malcolm Bain LOGICAL DATA MODELING: What It Is and How To Do It/ Alan Chmura and J. Mark Heumann DESIGNING AND EVALUATING E-MANAGEMENT DECISION TOOLS: The Integration of Decision and Negotiation Models into Internet-Multimedia Technologies/ Giampiero E.G. Beroggi INFORMATION AND MANAGEMENT SYSTEMS FOR PRODUCT CUSTOMIZATION/ Thorsten Blecker et al MEDICAL INFORMATICS: Knowledge Management and Data Mining in Biomedicine/ edited by Hsinchun Chen et al KNOWLEDGE MANAGEMENT AND MANAGEMENT LEARNING: Extending the Horizons of Knowledge-Based Management/ edited by Walter Baets INTELLIGENCE AND SECURITY INFORMATICS FOR INTERNATIONAL SECURITY: Information Sharing and Data Mining/ Hsinchun Chen ENTERPRISE COLLABORATION: On-Demand Information Exchange for Extended Enterprises/ David Levermore & Cheng Hsu SEMANTIC WEB AND EDUCATION/ Vladan Devedžić INFORMATION SYSTEMS ACTION RESEARCH: An Applied View of Emerging Concepts and Methods/ Ned Kock ONTOLOGIES: A Handbook of Principles, Concepts and Applications/ edited by Raj Sharman, Rajiv Kishore, Ram Ramesh METAGRAPHS AND THEIR APPLICATIONS/ Amit Basu and Robert W. Blanning SERVICE ENTERPRISE INTEGRATION: An Enterprise Engineering Perspective/ Cheng Hsu DIGITAL GOVERNMENT: E-Government Research, Case Studies, and Implementation/ Chen et al

TERRORISM INFORMATICS Knowledge Management and Data Mining for Homeland Security edited by

Hsinchun Chen Edna Reid Joshua Sinai Andrew Silke Boaz Ganor

Editors Hsinchun Chen University of Arizona Tucson, AZ, USA

Edna Reid Clarion University Clarion, PA, USA

Joshua Sinai The Analysis Corporation McLean, VA, USA

Andrew Silke University of East London United Kingdom

Boaz Ganor Lauder School of Government & Diplomacy Herzliya, Israel

Series Editors Ramesh Sharda Oklahoma State University Stillwater, Oklahoma, USA

ISBN-13: 978-0-387-71612-1

Stefan Voß Universität Hamburg Germany

e-ISBN-13: 978-0-387-71613-8

Library of Congress Control Number: 2008925539 © 2008 by Springer Science+Business Media, LLC All rights reserved. This work may not be translated or copied in whole or in part without the written permission of the publisher (Springer Science+Business Media, LLC, 233 Spring Street, New York, NY 10013, USA), except for brief excerpts in connection with reviews or scholarly analysis. Use in connection with any form of information storage and retrieval, electronic adaptation, computer software, or by similar or dissimilar methodology now know or hereafter developed is forbidden. The use in this publication of trade names, trademarks, service marks and similar terms, even if the are not identified as such, is not to be taken as an expression of opinion as to whether or not they are subject to proprietary rights. Printed on acid-free paper. 9 8 7 6 5 4 3 2 1 springer.com

TABLE OF CONTENTS Preface .................................................................................................... xv Editor Biographies ................................................................................. xix Author Biographies .............................................................................. xxv

UNIT I.

METHODOLOGICAL ISSUES IN TERRORISM RESEARCH

Chapter 1. Domain Mapping of Contemporary Terrorism Research Edna Reid and Hsinchun Chen Chapter Overview ................................................................................................ 3 1. Introduction................................................................................................... 4 2. Related Work ................................................................................................ 4 3. Research Design............................................................................................ 8 4. Results ........................................................................................................ 11 5. Conclusion .................................................................................................. 20 6. Acknowledgements ..................................................................................... 21 References ......................................................................................................... 21 Appendix: List of 42 Influential Terrorism Researchers ..................................... 23 Suggested Readings ........................................................................................... 26 Online Resources ............................................................................................... 26 Discussion Questions ......................................................................................... 26

Chapter 2. Research on Terrorism: A Review of the Impact of 9/11 and the Global War on Terrorism Andrew Silke Chapter Overview .............................................................................................. 27 1. Introduction................................................................................................. 28 2. The Nature of This Review.......................................................................... 32 3. Trends in Data-Gathering and Analysis........................................................ 33 4. Research on Terrorist Groups ...................................................................... 38 5. Research on Terrorist Tactics....................................................................... 41 6. Some Conceptual Issues .............................................................................. 44 7. Conclusions................................................................................................. 46 References ......................................................................................................... 48 Suggested Readings ........................................................................................... 49 Discussion Questions ......................................................................................... 49

v

vi

Table of Contents

Chapter 3. Who Are the Key Figures in “Terrorism Studies”? Sam Raphael Chapter Overview .............................................................................................. 51 1. Introduction................................................................................................. 52 2. Constructing the Framework: The Multiplicity of “Terrorism Studies,” the Role of the Audience, and the Importance of Methdological Rigor.......... 53 3. Employing the Framework: Selecting the Time Period; Constructing the Research Community ........................................................ 56 4. Constructing the Audience........................................................................... 59 5. Measuring the Opinions of the Relevant Audience: What Does the Peer Research Community Think?........................................ 60 6. Establishing the Threshold: Exactly What Determines an Expert as Key? ............................................................ 62 7. Conclusion .................................................................................................. 67 References and Footnotes ................................................................................... 69 Suggested Readings ........................................................................................... 72 Discussion Questions ......................................................................................... 72

Chapter 4. Interviewing Terrorists: A Case for Primary Research John Horgan Chapter Overview .............................................................................................. 73 1. Introduction................................................................................................. 74 2. Procuring Interviews ................................................................................... 75 3. A Case Illustration: Interviews with the IRA ............................................... 79 4. Finding and “Collecting” Participants .......................................................... 80 5. A Case Example: Interviewing a Terrorist................................................... 85 6. Interview Considerations ............................................................................. 89 7. Issues of Validity and Reliability ................................................................. 94 8. Conclusions................................................................................................. 96 Post-Script ......................................................................................................... 97 References ......................................................................................................... 97 Suggested Readings ........................................................................................... 99 Discussion Questions ......................................................................................... 99

Chapter 5. Resolving a Terrorist Insurgency by Addressing Its Root Causes Joshua Sinai Chapter Overview ............................................................................................ 101 1. Introduction............................................................................................... 102 2. Why Root Causes Are Significant.............................................................. 103 3. How to Resolve a Conflict’s Root Causes .................................................. 106 4. Conclusion ................................................................................................ 111

Table of Contents

vii

References and Footnotes ................................................................................. 112 Suggested Readings ......................................................................................... 114 Online Resources ............................................................................................. 114 Discussion Questions ....................................................................................... 114

Chapter 6. A Quantitative Analysis of “Root Causes of Conflict” Mihaela Bobeica, Jean-Paul Jéral, Teofilo Garcia, Clive Best Chapter Overview ............................................................................................ 115 1. Introduction............................................................................................... 116 2. Conflict Indicators and Automatic Data Analysis for Early Warning .......... 117 3. LSA Applied to English Articles in EMM.................................................. 120 4. Results and Discussion .............................................................................. 124 5. Conclusions and Future Work.................................................................... 131 References ....................................................................................................... 132 Suggested Readings ......................................................................................... 133 Online Resources ............................................................................................. 133 Discussion Questions ....................................................................................... 133 Appendix 1: Tables .......................................................................................... 134 Appendix 2: Conflict Indicators........................................................................ 136 Appendix 3: Figures ........................................................................................ 137 Appendix 4: Word Lists .................................................................................. 139

Chapter 7. Countering Terrorism with Knowledge James O. Ellis III Chapter Overview ............................................................................................ 141 1. Introduction............................................................................................... 142 2. Problems in Researching Terrorism ........................................................... 142 3. Problems in Terrorism Research ................................................................ 144 4. Problems in Terrorism Databases............................................................... 145 5. MIPT as an Information Clearinghouse...................................................... 147 6. MIPT-Funded Terrorism Databases ........................................................... 149 7. MIPT Terrorism Knowledge Base ............................................................. 150 8. Better Knowing What We Know about Terrorism ...................................... 151 9. Acknowledgements ................................................................................... 153 References ....................................................................................................... 153 Suggested Readings ......................................................................................... 154 Online Resources ............................................................................................. 154 Discussion Questions ....................................................................................... 155

Chapter 8. Toward a Target-specific Method of Threat Assessment Yael Shahar Chapter Overview ............................................................................................ 157

viii

Table of Contents

1. 2. 3. 4. 5.

Introduction............................................................................................... 158 Methodology............................................................................................. 158 Organization-specific Indicators ................................................................ 160 Synthesis................................................................................................... 169 Summary: Scenarios Most Likely to Be Carried out by Relevant Terrorist Groups.......................................................................... 171 6. Conclusion ................................................................................................ 172 Suggested Readings ......................................................................................... 173 Online Resources ............................................................................................. 174 Discussion Questions ....................................................................................... 174

Chapter 9. Identifying and Exploiting Group Learning Patterns for Counterterrorism Horacio R. Trujillo and Brian A. Jackson Chapter Overview ............................................................................................ 175 1. Introduction............................................................................................... 176 2. Organizational Learning ............................................................................ 177 3. A Four Stage Model of Organizational Learning ........................................ 178 4. Paths of Organizational Learning............................................................... 182 5. Determinants of Organizational Learning................................................... 183 6. How an Organizational Learning Model Can Inform the Design of Terrorism Informatics Systems .................................................. 186 7. Conclusions and Discussion....................................................................... 190 8. Acknowledgements ................................................................................... 191 Notes ............................................................................................................... 192 References ....................................................................................................... 194 Suggested Readings ......................................................................................... 195 Online Resources ............................................................................................. 195 Discussion Questions ....................................................................................... 195

Chapter 10. Homeland Insecurity: Data Mining, Privacy, Disclosure Limitation, and the Hunt for Terrorists Stephen E. Fienberg Chapter Overview ............................................................................................ 197 1. Introduction ............................................................................................. 198 2. Homeland Security and the Search for Terrorists ...................................... 200 3. Matching and Record Linkage Methods ................................................... 203 4. Encryption, Multi-party Computation, and Privacypreserving Datamining............................................................................. 205 5. Selective Revelation, Risk-utility Tradeoff, and Disclosure Limitation Assessment ..................................................... 207 6. Analyzing Network Data Based on Transactions ...................................... 210

Table of Contents

ix

7. Conclusions............................................................................................. 212 8. Acknowledgments ................................................................................... 214 Notes ............................................................................................................... 214 References ....................................................................................................... 215 Suggested Readings ......................................................................................... 217 Discussion Questions ....................................................................................... 218

UNIT II.

TERRORISM INFORMATICS TO SUPPORT PREVENTION, DETECTION, AND RESPONSE

Chapter 11. Case Study of Jihad on the Web: A Web Mining Approach Hsinchun Chen, Jialun Qin, Edna Reid, Yilu Zhou, and Marc Sageman Chapter Overview ............................................................................................ 221 1. Introduction............................................................................................... 222 2. Previous Research ..................................................................................... 222 3. Proposed Approach ................................................................................... 225 4. Analysis Results........................................................................................ 228 5. Discussion and Future Work...................................................................... 233 References ....................................................................................................... 234 Suggested Readings ......................................................................................... 235 Online Resources ............................................................................................. 235 Discussion Questions ....................................................................................... 235

Chapter 12. Studying Global Extremist Organizations’ Internet Presence Using the D ark W eb Attribute System: A Three Region Comparison Study Jialun Qin, Yilu Zhou, Edna Reid, and Hsinchun Chen Chapter Overview ............................................................................................ 237 1. Introduction............................................................................................... 238 2. Literature Review...................................................................................... 239 3. Studying Global Extremist Organizations’ Internet Usage: A ThreeRegion Empirical Study............................................................................. 243 4. Conclusions and Future Directions............................................................. 261 References ....................................................................................................... 263 Suggested Readings ......................................................................................... 265 Online Resources ............................................................................................. 265 Discussion Questions ....................................................................................... 266

x

Table of Contents

Chapter 13. Content Analysis of Jihadi Extremist Groups’ Videos Arab Salem, Edna Reid, and Hsinchun Chen Chapter Overview ............................................................................................ 267 1. Introduction ............................................................................................. 268 2. Related Work........................................................................................... 269 3. Methodology ........................................................................................... 272 4. Results..................................................................................................... 276 5. Conclusion .............................................................................................. 280 6. Acknowledgements.................................................................................. 281 References ....................................................................................................... 281 Suggested Readings ......................................................................................... 283 Online Resources ............................................................................................. 283 Discussion Questions ....................................................................................... 284

Chapter 14. Analysis of Affect Intensities in Extremist Group Forums Ahmed Abbasi and Hsinchun Chen Chapter Overview ............................................................................................ 285 1. Introduction ............................................................................................. 286 2. Related Work........................................................................................... 287 3. Research Gaps and Questions................................................................... 292 4. Research Questions.................................................................................. 293 5. Research Design ...................................................................................... 294 6. System Design......................................................................................... 294 7. Evaluation ............................................................................................... 297 8. Results..................................................................................................... 300 9. Conclusions............................................................................................. 303 References ....................................................................................................... 304 Suggested Readings ......................................................................................... 306 Online Resources ............................................................................................. 306 Discussion Questions ....................................................................................... 307

Chapter 15. Document Selection for Extracting Entity and Relationship Instances of Terrorist Events Zhen Sun, Ee-Peng Lim, Kuiyu Chang, Maggy Anastasia Suryanto, and Rohan Kumar Gunaratna Chapter Overview ............................................................................................ 309 1. Introduction ............................................................................................. 310 2. Literature Review .................................................................................... 313 3. Domain Specific Event Entity Relation Extraction Task with Document Ranking ................................................. 317 4. Case Studies ............................................................................................ 325 5. Conclusions and Discussion ..................................................................... 343 6. Acknowledgements.................................................................................. 344

Table of Contents

xi

References ....................................................................................................... 344 Suggested Readings ......................................................................................... 346 Online Resources ............................................................................................. 346 Discussion Questions ....................................................................................... 346

Chapter 16. Data Distortion Methods and Metrics in a Terrorist Analysis System Shuting Xu and Jun Zhang Chapter Overview ............................................................................................ 347 1. Introduction ............................................................................................. 348 2. Terrorist Analysis System ........................................................................ 350 3. Data Distortion ........................................................................................ 350 4. Data Distortion Measures......................................................................... 354 5. Utility Measure........................................................................................ 357 6. Experiments and Results .......................................................................... 358 7. Conclusions and Discussions.................................................................... 361 References ....................................................................................................... 362 Suggested Readings ......................................................................................... 364 Online Resources ............................................................................................. 364 Discussion Questions ....................................................................................... 364

Chapter 17. Content-Based Detection of Terrorists Browsing the Web Using an Advanced Terror Detection System (ATDS) Yuval Elovici, Bracha Shapira, Mark Last, Omer Zaafrany, Menahem Friedman, Moti Schneider, and Abraham Kandel Chapter Overview ............................................................................................ 365 1. Introduction ............................................................................................. 366 2. Related Work........................................................................................... 367 3. Advanced Terrorist Detection System ...................................................... 368 4. Evaluation ............................................................................................... 374 5. Conclusions and Discussion ..................................................................... 381 6. Acknowledgements.................................................................................. 382 References ....................................................................................................... 382 Suggested Readings ......................................................................................... 384 Online Resources ............................................................................................. 384 Discussion Questions ....................................................................................... 384

Chapter 18. Text Mining the Biomedical Literature for Identification of Potential Virus/Bacterium as Bio-terrorism Weapons Xiaohua Hu, Xiaodan Zhang, Daniel Wu, Xiaohua Zhou, and Peter Rumm Chapter Overview ............................................................................................ 385 1. Introduction ............................................................................................. 386

xii

Table of Contents

2. Related Works ......................................................................................... 387 3. Background of Virus and Bacterium......................................................... 387 4. Method.................................................................................................... 389 5. Experimental Results ............................................................................... 394 6. Potential Significance for Public Health and Homeland Security............... 404 7. Acknowledgements.................................................................................. 404 References ....................................................................................................... 404 Suggested Readings ......................................................................................... 405 Online Resources ............................................................................................. 405 Discussion Questions ....................................................................................... 405

Chapter 19. Leveraging One-Class SVM and Semantic Analysis to Detect Anomalous Content Ozgur Yilmazel, Svetlana Symonenko, Niranjan Balasubramanian, and Elizabeth D. Liddy Chapter Overview ............................................................................................ 407 1. Introduction ............................................................................................. 408 2. Overview of Related Work....................................................................... 409 3. Case Study: One-class Categorization Approach to the Problem of Identifying Anomalous Content ........................................ 411 4. Conclusions and Discussion ..................................................................... 420 References ....................................................................................................... 421 Acknowledgements ......................................................................................... 423 Suggested Readings ........................................................................................ 423 Online Resources ............................................................................................. 423 Discussion Questions ....................................................................................... 423

Chapter 20. Individual and Collective Analysis of Anomalies in Message Traffic D.B. Skillicorn Chapter Overview ............................................................................................ 425 1. Introduction ............................................................................................. 426 2. Analysis of Single Messages .................................................................... 428 3. Analysis of Multiple Messages................................................................. 435 4. Conclusions............................................................................................. 447 5. Acknowledgements.................................................................................. 448 References ....................................................................................................... 448 Suggested Readings ......................................................................................... 449 Discussion Questions ....................................................................................... 449

Table of Contents

xiii

Chapter 21. Addressing Insider Threat through Cost-Sensitive Document Classification Young-Woo Seo and Katia Sycara Chapter Overview ............................................................................................ 451 1. Introduction ............................................................................................. 452 2. Related Work........................................................................................... 454 3. Overview................................................................................................. 455 4. Classification for Confidential Authorization............................................ 457 5. Experiments............................................................................................. 461 6. Conclusion .............................................................................................. 468 7. Acknowledgments ................................................................................... 470 References ....................................................................................................... 470 Suggested Readings ......................................................................................... 471 Online Resources ............................................................................................. 472 Discussion Questions ....................................................................................... 472

Chapter 22. Using Web Mining and Social Network Analysis to Study the Emergence of Cyber Communities in Blogs Michael Chau and Jennifer Xu Chapter Overview ............................................................................................ 473 1. Introduction ............................................................................................. 474 2. Research Background .............................................................................. 475 3. Research Questions.................................................................................. 479 4. A Framework for Blog Collection and Analysis........................................ 480 5. A Case Study on Xanga ........................................................................... 483 6. Conclusion and Future Directions............................................................. 488 7. Acknowledgements.................................................................................. 489 References ....................................................................................................... 489 Appendix ......................................................................................................... 492 Suggested Readings ......................................................................................... 493 Online Resources ............................................................................................. 493 Discussion Questions ....................................................................................... 493

Chapter 23. Automatic Extraction of Deceptive Behavioral Cues from Video Thomas O. Meservy, Matthew L. Jensen, W. John Kruse, Judee K. Burgoon, and Jay F. Nunamaker Jr. Chapter Overview ............................................................................................ 495 1. Introduction ............................................................................................. 496 2. Literature Review .................................................................................... 496 3. Research Method and Examples............................................................... 501

xiv

Table of Contents

4. Experiments and Results .......................................................................... 510 5. Conclusion .............................................................................................. 512 6. Acknowledgements.................................................................................. 513 References ....................................................................................................... 513 Suggested Readings ......................................................................................... 515 Online Resources ............................................................................................. 515 Discussion Questions ....................................................................................... 516

Chapter 24. Situational Awareness Technologies for Disaster Response Naveen Ashish, Ronald Eguchi, Rajesh Hegde, Charles Huyck, Dmitri Kalashnikov, Sharad Mehrotra, Padhraic Smyth, and Nalini Venkatasubramanian Chapter Overview ............................................................................................ 517 1. Introduction ............................................................................................. 518 2. Situational Awareness.............................................................................. 523 3. Event Extraction ...................................................................................... 527 4. Event Data Management .......................................................................... 531 5. Event Analysis and Visualization ............................................................. 534 6. Artifacts .................................................................................................. 539 7. Conclusion .............................................................................................. 541 8. Acknowledgements.................................................................................. 542 References ....................................................................................................... 542 Online Resources ............................................................................................. 544 Questions for Discussion .................................................................................. 544

Author Index ................................................................................................ 545 Subject Index ............................................................................................... 547

PREFACE Terrorism informatics is defined as the application of advanced methodologies and information fusion and analysis techniques to acquire, integrate, process, analyze, and manage the diversity of terrorism-related information for national/international and homeland security-related applications. These techniques are derived from disciplines such as computer science, informatics, statistics, mathematics, linguistics, social sciences, and public policy. Because the study of terrorism involves copious amounts of information from multiple sources, data types, and languages, information fusion and analysis techniques such as data mining, data integration, language translation technologies, and image and video processing are playing key roles in the future prevention, detection, and remediation of terrorism 1 . Within the homeland security industry, information fusion is defined as the use of computer technology to acquire data from many sources, integrate this data into usable and accessible forms, and interpret the results2. Although there has been substantial investment and research in the application of computer technology to terrorism, much of the literature in this emerging area is fragmented and often narrowly focused within specific domains such as engineering, computer science, computer security, information systems, knowledge management, and biomedicine. The goal of this edited volume is to present an interdisciplinary and understandable review of terrorism informatics work for homeland security along two dimensions: methodological issues in terrorism research, including information infusion techniques to support terrorism prevention, detection, and response; and legal, social, privacy, and data confidentiality challenges and approaches.

SCOPE AND ORGANIZATION This book has been grouped into two units. Unit I focuses on the methodological issues in terrorism research including trends, achievements and failures in terrorism research, methodological challenges in terrorism, challenges in retrieving and sharing terrorism information resources, and root causes of terrorism and the implications for terrorism informatics. It

1

2

National Research Council, 2003. Making the Nation Safer: the Roles of Science and Technology in Countering Terrorism, p11. Ibid, p. 166.

xv

xvi

Preface

also attends to critical socio-technical topics relevant to information and knowledge management such as privacy, data confidentiality, and legal challenges. Unit I chapters address the following topics and concepts: · Mapping the domain of terrorism research · Identifying key terrorism researchers · The impact on 9/11 on terrorism · Primary sources for the study of terrorism · Analyzing the root causes of terrorism · The construction of information resources useful for the study of terrorism · Threat assessment and analysis · Methods to support counterterrorism · Data mining and privacy concerns Unit 2 presents current research, including case studies, on the application of terrorism informatics techniques (such as web mining, social network analysis, and multimodal event extraction and analysis) to the terrorism phenomenon. Unit 2 focuses on three major areas of terrorism research: prevention, detection, and response as identified by the National Research Council 3 and the U.S. White House’s Office of Science and Technology Program (OSTP). 4 Unit III will present the critical sociotechnical topics relevant to information and knowledge management: social, privacy, data confidentiality, and legal challenges. · Examining “Jihad” on the world wide web · Comparing extremist groups websites across regions · Analyzing extremist communications as manifested in web forums · Terrorist analysis systems and detection · Identification of potential bioterrorist weapons · Detecting and analyzing anomalous content · Examining “insider” threats · Using web mining and social network analysis · Video analysis and deception detection · Situational awareness technologies for disaster response

3 4

Ibid., p. 167. Zahn, M.A. and Strom, K.J., 2004, “Terrorism and the Federal Social Science Research Agenda”. Edited by M. Deflem. In Terrorism and Counter-Terrorism: Criminological Perspectives. Elsevier p112.

Preface

xvii

CHAPTER STRUCTURE Each chapter follows a consistent structure to ensure uniformity and ease of use: · Title · Authors and affiliations · Introduction: introduces the relevance and significance of the topic · Literature review/Overview of the field: a systematic review of related works in the topic area · Case study/Methods/Examples: One or two detailed studies or examples of selected techniques, systems, implementations and evaluations · Conclusion and discussion · Acknowledgements · References and notes · Suggested readings · Online resources · Questions for discussion The work is further enhanced by author and subject indexes at the back of the book, intended to facilitate ease of access to the contents./

INTENDED AUDIENCE The audience of the book is intentionally broad. It is intended to bring useful knowledge to scientists, security professionals, counterterrorism experts, and policy makers. It is also intended to serve as reference material and as a textbook in graduate-level courses related to information security, information policy, information assurance, information systems, terrorism, and public policy. Readers will learn new concepts, technologies, and practices developed in terrorism informatics through the comprehensive reviews of recent work and detailed case studies presented in each chapter. Students and researchers will broaden their understanding and knowledge in these new research topics. Practitioners will be able to better evaluate and/or employ new and alternative technologies for their current projects and future work.

EDITOR BIOGRAPHIES Dr. Hsinchun Chen is McClelland Professor of Management Information Systems at the University of Arizona and Andersen Consulting Professor of the Year (1999). He received the B.S. degree from the National Chiao-Tung University in Taiwan, the MBA degree from SUNY Buffalo, and the Ph.D. degree in Information Systems from the New York University. Dr. Chen is a Fellow of IEEE and AAAS. He received the IEEE Computer Society 2006 Technical Achievement Award. He is the author/editor of 15 books, 17 book chapters, and more than 150 SCI journal articles covering intelligence analysis, biomedical informatics, data/text/web mining, digital library, knowledge management, and Web computing. His recent books include: Intelligence and Security Informatics for International Security: Information Sharing and Data Mining, and Digital Government: E-Government Research, Case Studies, and Implementationi (Springer). Dr. Chen was ranked eighth in publication productivity in Information Systems (CAIS 2005) and first in Digital Library research (IP&M 2005) in two recent bibliometric studies. He serves on ten editorial boards including: ACM Transactions on Information System; ACM Journal on Educational Resources in Computing; IEEE Transactions on Intelligent Transportation Systems; IEEE Transactions on Systems, Man, and Cybernetics; Journal of the American Society for Information Science and Technology; Decision Support Systems; and International Journal on Digital Library. Dr. Chen has served as a Scientific Counselor/Advisor to the National Library of Medicine (USA), Academia Sinica (Taiwan), and the National Library of China (China). He has been an advisor for major NSF, DOJ, NLM, DOD, DHS, and other international research programs in digital government, national security research, medical informatics, and digital library. Dr. Chen is the founding director of the Artificial Intelligence Lab and Hoffman ECommerce Lab. The UA Artificial Intelligence Lab, which houses 25+ researchers, has received more than $20M in research funding from NSF, NIH, NLM, DOD, DOJ, CIA, DHS, and other agencies over the past 17 years. Dr. Chen is the (founding) conference co-chair of the IEEE International Conferences on Intelligence and Security Informatics (ISI) 2003-2007. The ISI conference, which has been sponsored by NSF, CIA, DHS, and NIJ, has become the premiere meeting for international and homeland security IT research. Dr. Chen’s COPLINK system, which has been quoted as a national model for public safety information sharing and analysis, has been adopted in more than 550 jurisdictions nation-wide. COPLINK research had been featured in the New York Times, Newsweek, Los Angeles Times, Washington Post, Boston Globe, and ABC News, xix

xx

Editor Biographies

among others. The COPLINK project was selected as a finalist by the prestigious International Association of Chiefs of Police (IACP)/Motorola 2003 Weaver Seavey Award for Quality in Law Enforcement in 2003. COPLINK research has recently been expanded to border protection (BorderSafe), disease and bioagent surveillance (BioPortal), and terrorism informatics research (Dark Web), funded by NSF, CIA, and DHS. In collaboration with Customs and Border Protection (CBP), the BorderSafe project develops criminal network analysis and vehicle association mining research for border-crosser risk assessment. The BioPortal system supports interactive geospatial analysis and visualization, chief complaint classification, and phylogenetic analysis for public health and biodefense. In collaboration with selected international terrorism research centers and intelligence agencies, the Dark Web project has generated one of the largest databases in the world about extremist/terrorist-generated Internet contents (web sites, forums, and multimedia documents). Dark Web research supports link analysis, content analysis, web metrics analysis, multimedia analysis, sentiment analysis, and authorship analysis of international terrorism content. The project has been featured in the Associated Press, Fox News, National Public Radio (NPR), the British Broadcasting Corporation (BBC), the NSF Press, Discover Magazine, the Arizona Republic, and the Toronto Star, among others. Dr. Chen is the founder of the Knowledge Computing Corporation, a university spin-off company and a market leader in law enforcement and intelligence information sharing and data mining. Dr. Chen has also received numerous awards in information technology and knowledge management education and research including: AT&T Foundation Award, SAP Award, the Andersen Consulting Professor of the Year Award, the University of Arizona Technology Innovation Award, and the National Chaio-Tung University Distinguished Alumnus Award. Dr. Edna Reid is an Associate Professor at Clarion University, Pennsylvania. Formerly, she was a senior research scientist and project manager in the Artificial Intelligence Laboratory at the University of Arizona, Tucson. She was an Associate Professor with Nanyang Business School, NTU, Singapore, and the president of the Society of Competitive Intelligence Professionals Singapore (SCIPSgp). Formerly, she was an entrepreneur with an Internet start-up in Malaysia. In 1993, she joined the Division of Information Studies, NTU. Prior to going to Asia, Edna was at the School of Communication, Information and Library Studies, Rutgers University. In 1990, she was a postdoctoral researcher at the University of California, Berkeley, where she conducted research in terrorism information services. She also served as a senior systems analyst and data analyst team

Editor Biographies

xxi

leader at private enterprises in both Germany and northern Virginia in the U.S.. She has analytical and library sciences experience in the intelligence community. Her areas of specialization include competitive intelligence, web mining, and terrorism informatics. Her research focuses on web mining of extremist groups' digital artifacts (e.g., web sites, forums, multimedia). She has published in a number of journals, conference proceedings, and edited collections. She received a Certificate in Management Information Systems (MIS) from American University in 1984, and the DLS (Library Science) degree from the University of Southern California in 1983. She also holds a bachelors degree in Education from D.C. Teachers College and a Masters Degree in library science from the University of Maryland. Dr. Joshua Sinai is a Program Manager for counter-terrorism studies & education at The Analysis Corporation (TAC) (www.theanalysiscorp.com), in McLean, VA. His government contracts range from a project to map the worldwide landscape of terrorism & counterterrorism studies to an assessment of tribalism in Iraq. He also assists in developing curriculum on counterterrorism analysis to TACLearn, TAC’s internal distance learning educational program. Prior to joining TAC in June 2006, Dr. Sinai worked at Logos Technologies and ANSER (Analytical Services), from which for 18 months he was seconded to function as a government official in the Science & Technology Directorate, Department of Homeland Security, where he managed a project on the social and behavioral components of terrorism and its impact on society. As part of his duties, he co-chaired an interagency working group, under the White House Office of Science & Technology Policy, on how the social, behavioral and economic sciences can contribute to counterterrorism, which produced a report on this subject in April 2005. He also contributed to the formulation of the announcement for proposals to create the DHS center on terrorism studies and served on the evaluation committee to review all proposals. Dr. Sinai’s publications include chapters in edited academic volumes, national security journals, and his column on Terrorism Books appears regularly in the Washington Times’ book review section. He has also published newspaper articles on terrorists’ use of the Internet and how the special operations community approaches counterterrorism. He is a frequent presenter at academic conferences on terrorism & counterterrorism. Dr. Sinai can be reached at: [email protected]. Dr. Andrew Silke currently holds a Chair in Criminology at the University of East London where he is the Programme Director for Terrorism Studies. He has a background in forensic psychology and has worked both in academia and for government. His research and writings are

xxii

Editor Biographies

published extensively in academic journals, books and the popular press. He is the author of over 100 articles and papers on subjects relating to terrorism, and has given numerous papers and invited lectures on these topics at conferences and universities across the world. In recent years, he has worked with a wide range of scientific, government and law enforcement agencies, including the U.S. Federal Bureau of Investigation, the United States Department of Justice, the United States Department of Homeland Security, NATO, the United States National Academy of Sciences, the Royal Society, the United Nations, the European Defence Agency, the European Commission, the Metropolitan Police and the House of Commons. He has also provided risk assessment and acted as an expert witness in several terrorism-related cases. Professor Silke serves by invitation on both the European Commission’s Expert Group on Violent Radicalisation, and the United Nations Roster of Terrorism Experts. He is an Honorary Senior Research Associate of the renowned Centre for the Study of Terrorism and Political Violence at the University of St Andrews and is a Fellow of the University of Leicester. His work has taken him to Northern Ireland, the Middle East and Latin America. Dr. Boaz Ganor is the associate dean of the Lauder School of Government, the founder and executive director of the International Policy Institute for Counter-Terrorism (ICT), and the head of the Homeland Security Studies program (Graduate degree, Executive program and Bachelor specialization) at the Interdisciplinary Center Herzliya, Israel. He is also the founder and Chairman of the International Counter Terrorism Academic Community (ICTAC). In addition, Dr. Ganor is a senior fellow of MIPT (The Memorial Institute for Prevention of Terrorism, Oklahoma City, USA) and a member of the International Advisory Council of the International Centre for Political Violence and Terrorism Research at the Institute of Defense and Strategic Studies (IDSS), Nanyang Technological University, The Republic of Singapore. Dr. Ganor is also a member of the board of directors of ICSR – The International Centre for the Study of Radicalization and Political Violence (a partnership of the University of Pennsylvania (U.S.A.), the Interdisciplinary Center (Israel), King’s College (London, U.K.), and The Jordanian Institute of Diplomacy). Past positions for Dr. Ganor have included membership in the Israeli Delegation to the Trilateral (American-Palestinian-Israeli) Committee for Monitoring Incitement to Violence and Terrorism as well as the Israeli National Committee for Homeland Security Technologies. He has served as an advisor on counter-terrorism topics to the Israeli Ministry of Defense, the Israeli Counter-Terrorism Coordinator in the Prime Minister’s office, Israel National Security Council, and the Israeli Transportation Ministry during

Editor Biographies

xxiii

the peace talks with Jordan. In addition, he advised Prime Minister Benjamin Nethanyahu on his book Fighting Terrorism. Dr. Ganor has been widely published and some of his key works have included Israel’s Counter-Terrorism Strategy – Efficacy versus Liberal–Democratic Values (Political Science, The Hebrew University, Jerusalem, Israel, 2002), and Terrorism and Public Opinion in Israel (Tel-Aviv University, Israel, 1989). In addition, Dr. Ganor has written numerous articles on the topic of terrorism and counterterrorism. His latest book, The Counter-Terrorism Puzzle – A guide for decision makers (Transaction Publishers, 2005), is currently being used as a textbook is several universities. Dr. Ganor is also the editor of Trends in International Terrorism (2007), Hypermedia Seduction for Terrorist Recruiting (2007), and Post Modern Terrorism (2005).

AUTHOR BIOGRAPHIES Ahmed Abbasi is a research associate at the Artificial Intelligence Lab and a doctoral student in the Management Information Systems department at the University of Arizona. He received his BS degree and MBA from Virginia Tech. His research interests include text mining, computer mediated communication, information visualization, and knowledge management. Naveen Ashish is a Research Scientist and Research Faculty Member at the University of California, Irvine where he is affiliated with Calit2. He is the project leader of the SAMI project on situational awareness, within the larger (NSF funded) RESCUE project on advancing information technologies for disaster response. His research interests and expertise span various areas in data management and AI, including information integration, information extraction, and information semantics. He received his PhD in Computer Science from the University of Southern California in 2000 and worked at the NASA Ames Research Center before joining UCI. Niranjan Balasubramanian is currently a doctoral student at the Center for Intelligent Information Retrieval (CIIR) in the Department of Computer Science at the University of Massachusetts, Amherst. His research interests include information retrieval, extraction, text classification and question answering. Prior to joining CIIR, Balasubramanian was a Software Engineer at the Center for Natural Language Processing where he participated in research and development of several natural language processing technologies and their applications. Clive Best is a senior researcher within the “Support to External Security” Unit at the JRC’s “Institute for the Protection and the Security of the Citizen” in Ispra, Italy. With a background in information technology, he is presently carrying our research on information processing, based on a media monitor system (Europe Media Monitor-EMM) developed at the Joint Research Centre. The Joint Research Centre (JRC) is one of the directorates general of the European Commission and it includes seven different research institutes located in several EU member states. The JRC’s mission is to provide customer-driven scientific and technical support for the conception, development, implementation and monitoring of EU policies. It functions as a centre of science and technology reference for the EU independent of commercial and national interests. The JRC supports the policy-maker in addressing the concerns of the individual citizen, undertaking research in different fields such as security, health, agriculture, xxv

xxvi

Author Biographies

environment and energy. Mihaela Bobeica has a background in language sciences and language technology. For the last few years her research focused on data processing and information systems for policy-making support, electronic governance and electronic democracy. She has worked as a researcher for several European research institutes, at international and national levels. She has several publications on data processing for policy-making support and electronic governance. Presently she is working at the Council of Europe in Strasbourg, France, on information systems and policy development for good governance in the Information Society. Judee K. Burgoon is Professor of Communication, Family Studies and Human Development, at the University of Arizona, where she is Site Director for the Center for Identification Technology Research, Director of Research for the Center for the Management of Information, and Associate Director of the Media Interface Network Design Lab in the Eller College of Management, University of Arizona. Professor Burgoon has authored seven books and monographs and over 250 articles, chapters and reviews related to deception, nonverbal and relational communication, computer-mediated communication, research methods, and media use. A recent survey identified her as the most prolific female scholar in communication in the 20th century. She is the recipient of the National Communication Association's Distinguished Scholar Award, its highest award for a lifetime of scholarly achievement, and the International Communication Association’s Steven H. Chaffee Career Productivity Award, also its highest award for scholarly achievement. Dr. Kuiyu Chang joined the School of Computer Engineering of Nanyang Technological University in 2003 as an Assistant Professor in Information Systems. Prior to that, he served as Senior Risk Management Analyst for ClearCommerce (Texas). In 2001, he founded Mosuma (Texas). From 2000 to 2002 he was Member of Technical Staff at Interwoven (Texas). In 2000, he was also one of the core employees of the startup company Neonyoyo (Texas), which was acquired by Interwoven for US$70m. Kuiyu is a member of IEEE, ACM. He has served as program cochair for Intelligence and Security Informatics workshops 2006 and 2007, publications chair for PAKDD2006, and Programme Committee member of several international conferences. He received his Ph.D. from the University of Texas at Austin, M.S. from the University of Hawaii at Manoa, and B.S. from National Taiwan University, all in Electrical Engineering.

Author Biographies

xxvii

Michael Chau is currently an Assistant Professor and the BBA(IS)/BEng(CS) Program Coordinator in the School of Business at the University of Hong Kong. He received his Ph.D. degree in Management Information Systems from the University of Arizona and a Bachelor degree in Computer Science (Information Systems) from the University of Hong Kong. When at Arizona, he was an active researcher in the Artificial Intelligence Lab, where he participated in several research projects funded by NSF, NIH, NIJ, and DARPA. His research has been published in such international journals as Communications of the ACM, ACM Transactions on Information Systems, IEEE Transactions on SMC, IEEE Computer, Decision Support Systems, and Journal of the American Society for Information Science and Technology. Ronald Eguchi is President and CEO of ImageCat, Inc., a risk management company specializing in the development and use of advanced technologies for risk assessment and reduction. Mr. Eguchi has over 30 years of experience in risk analysis and risk management studies. He has directed major research and application studies in these areas for government agencies and private industry. He currently serves on several Editorial Boards including the Natural Hazards Review published by the American Society of Civil Engineers and the Natural Hazards Research and Applications Information Center, University of Colorado, and the Journal on Uncertainties in Engineering Mechanics published by Resonance Publications, Inc. He is also a past member of the Editorial Board of the Earthquake Engineering Research Institute’s Journal SPECTRA. He is a past member of the Scientific Advisory Committee of the U.S. Geological Survey, a committee that reports to Congress on recommended research directions for the USGS in the area of earthquake hazard reduction. In 1997, he was awarded the ASCE C. Martin Duke Award for his contributions to the area of lifeline earthquake engineering. He still remains active in the ASCE Technical Council on Lifeline Earthquake Engineering serving on several committees and having chaired the Council’s Executive Committee in 1991. In 1992, Mr. Eguchi was asked to chair a panel, established jointly by the Federal Emergency Management Agency and the National Institute of Standards and Technology, to develop a plan for assembling and adopting seismic design standards for public and private lifelines in the U.S. This effort has led to the formation of the American Lifeline Alliance, currently managed by the National Institute of Building Sciences. Mr. Eguchi currently serves on MCEER’s (Multidisciplinary Center for Earthquake Engineering Research) Research Committee for Transportation Research. He is a member of the National Research Council’s Disaster Roundtable. He is also a charter member of the Mayor’s

xxviii

Author Biographies

Blue Ribbon Panel on Seismic Hazards for the City of Los Angeles. He has authored over 200 publications, many of them dealing with the seismic risk of utility lifeline systems. James “Chip” O. Ellis III is the Research and Program Director for the Memorial Institute for the Prevention of Terrorism (MIPT), which he joined in March 2001. MIPT works to counter terrorism with knowledge and acts as a national point of contact for antiterrorism information sharing. MIPT is funded through the U.S. Department of Homeland Security. Chip completed his Master’s of Letters in International Security Studies at the University of St Andrews in Scotland. His research program focused on terrorism and weapons of mass destruction. Chip also graduated summa cum laude from the University of Oklahoma with two Bachelor’s of Arts degrees in political science and linguistics. Prior to MIPT, Chip served in the Response Division of the Oklahoma Department of Civil Emergency Management, where he developed plans and procedures for the State’s terrorism program and revised the State Emergency Operations Plan to address Federal and State authorities during WMD events. Before this, he worked at the University of Oklahoma Police Department. Yuval Elovici is a Senior Lecturer in the Department of Information Systems Engineering at Ben-Gurion University of the Negev and the Director of the University's Deutsche Telekom Laboratories. His research interests include information warfare, data mining, information retrieval, and detection of malicious code. He received his PhD in information systems from Tel-Aviv University. Contact him at DT Labs, Ben-Gurion Univ., PO Box 653, Beer- Sheva, Israel, 84105; [email protected]. Stephen E. Fienberg is Maurice Falk University Professor of Statistics and Social Science at Carnegie Mellon University, with appointments in the Department of Statistics, the Machine Learning, and Cylab. He has served as Dean of the College of Humanities and Social Sciences at Carnegie Mellon and as Vice President for Academic Affairs at York University, in Toronto, Canada, as well as on the faculties of the University of Chicago and the University of Minnesota. He was founding co-editor of Chance and served as the Coordinating and Applications Editor of the Journal of the American Statistical Association. He is currently one of the founding editors of the Annals of Applied Statistics and is co-founder of the new online Journal of Privacy and Confidentiality, based in Cylab. He has been Vice President of the American Statistical Association and President of the Institute of Mathematical Statistics and the International Society for Bayesian Analysis. His research includes the development of statistical methods, especially tools for categorical data analysis. His work on

Author Biographies

xxix

confidentiality and disclosure limitation addresses issues related to respondent privacy in both surveys and censuses and especially to categorical data analysis. Fienberg is the author or editor of over 20 books and 300 papers and related publications. His two books on categorical data analysis are Citation Classics. Fienberg is a prominent as an advisor to government agencies and to congress. He served two terms as Chair of the Committee on National Statistics at the National Research Council (NRC) during the 1980s. Recently, he chaired the NRC committee on the scientific validity of the polygraph and served as a member of the NRC panel on measuring discrimination. He currently serves on the NRC Committee on Technical and Privacy Dimensions of Information for Terrorism Prevention and Other National Goals, and is a member of the NAS-NRC Report Review Committee. He is a member of the U. S. National Academy of Sciences, and a fellow of the Royal Society of Canada, and the American Academy of Political and Social Science. He is also a longtime fellow of the American Association for the Advancement of Science, the American Statistical Association, and the Institute of Mathematical Statistics. He was the 1982 recipient of the Committee of Presidents of Statistical Societies Presidents’ award as the Outstanding Statistician under the age of 40, and the 2002 recipient of the Samuel S. Wilks Award of the American Statistical Association recognizing his distinguished career in statistics. Menahem Friedman, born in Jerusalem, Israel, received his M.Sc. in Mathematics from the Hebrew University in Jerusalem (1962) and his Ph.D. in Applied Mathematics from the Weizmann Institute of Science in Rehovot. From 1969 – 2005 he was a Senior Research Scientist at the Nuclear Research Center – Negev and in addition from 1969 – 1992 an Associate Professor at the Departments of Mathematics, Electrical Engineering and Computer Science teaching various courses in Applied Mathematics and Data Structure. Dr. Friedman has published numerous papers in the areas of Numerical Analysis and Fuzzy Mathematics, has contributed to several books in Numerical Analysis and Co-authored books in Numerical Analysis and Pattern Recognition. Since 2004 he is involved in designing mathematical models for detecting terrorist activity on the Internet. Teofilo Garcia is a senior researcher within the “Support to External Security” Unit at the JRC’s “Institute for the Protection and the Security of the Citizen” in Ispra, Italy. With a backgrounds in information technology, he is presently carrying our research on information processing, based on a media monitor system (Europe Media Monitor-EMM) developed at the JRC. Research results are meant to support EU policy-makers in the field of

xxx

Author Biographies

security and terrorism. Dr. Rohan Gunaratna is Head of the International Centre for Political Violence and Terrorism Research, Singapore. A former senior fellow at the Combating Terrorism Centre, United States Military Academy at West Point, he is a senior fellow at the Jebsen Centre for Counter Terrorism Studies, Fletcher School for Law and Diplomacy and the National Memorial Institute for the Prevention of Terrorism, Okalahoma. He holds a masters degree in international peace studies from the University of Notre Dame, Indiana, US, and a doctorate in international relations from the University of St Andrews, Scotland, UK. He led the specialist team that designed the UN Database into the Mobility, Finance and Weapons of Al Qaeda, Taliban and their Entities. He was invited to testify before the 9-11 Commission.He is the author of 12 books including "Inside Al Qaeda: Global Network of Terror," Columbia University Press, New York. He serves on the editorial boards of "Studies in Conflict and Terrorism" and "Terrorism and Political Violence," leading counter-terrorism academic journals. Dr. Rajesh M. Hegde graduated with a Ph.D (2005) in Computer Science and Engineering from the Indian Institute of Technology Madras (IIT-M), India. He is currently working as a Researcher at the California Institute of Telecommunication and Information Technology (CALIT2), at the University of California, San Diego. At CALIT2, he is involved in projects that highlight the interplay of multi-modal signal processing with wireless networking. His research interests include feature extraction for speech recognition, speaker identification, situation-aware ubiquitous computing, and multi-modal information fusion. Dr. John Horgan is Senior Research Fellow at the Centre for the Study of Terrorism and Political Violence, University of St. Andrews, where is also Lecturer in International Relations. A Chartered Psychologist, his research interests relate to psychological aspects of political violence, with a particular focus on understanding how and why people become involved in, and disengage from, terrorism. Some of his previous research has examined political violence in Ireland, and the relationship between Irish Republican terrorism and organised crime, especially in the context of the group and organisational dynamics of terrorist movements. Dr Horgan’s work is widely published. His books include The Future of Terrorism (2000, coedited with Max Taylor) and The Psychology of Terrorism (2005). In July 2006, he was awarded an Airey Neave Trust Fellowship for an 18-month research project on how and why individuals disengage from terrorist movements. On the basis of this research, his new book Walking Away

Author Biographies

xxxi

From Terrorism: Accounts of Disengagement from Radical and Extremist Movements will be published by Routledge in 2008. It contains detailed first hand interviews he has conducted with members of 13 terrorist movements. Dr. Horgan is regularly invited to speak to a variety of government, police, and military audiences around the world, and since 2005, he has been a member of the European Commission Expert Group on Violent Radicalisation. Dr. Xiaohua Hu is currently an assistant professor and founding director of the data mining and bioinformatics lab at the College of Information Science and Technology, Drexel University. His current research interests are in biomedical literature data mining, bioinformatics, text mining, semantic web mining and reasoning, rough set theory and application, information extraction and information retrieval. He has published more than 140 peer-reviewed research papers in various journals, conferences and books such as various IEEE/ACM Transactions, PR, JIS, KAIS, CI, DKE, IJBRA, SIG KDD, IEEE ICDM, IEEE ICDE, SIGIR, ACM CIKM, IEEE BIBE, IEEE CICBC etc, co-edited 8 books/proceedings. He has received a few prestigious awards including the 2005 National Science Foundation (NSF) Career award, the best paper award at the 2004 IEEE Symposium on Computational Intelligence in Bioinformatics and Computational Biology, the 2006 IEEE Granular Computing Outstanding Service Award, and the 2001 IEEE Data Mining Outstanding Service Award. He has also served as a program co-chair/conference co-chair of nine international conferences/ workshops and a program committee member in more than 50 international conferences in the above areas. He is the founding editor-in-chief of the International Journal of Data Mining and Bioinformatics, an associate editor/editorial board member of four international journals (KAIS, IJDWM, IJSOI and JCIB), and the founding advisory board member and secretary of the IEEE Granular Computing Task Force. His research projects are funded by the National Science Foundation (NSF), US Dept. of Education, and the PA Dept. of Health. Charles K. Huyck is Senior Vice President of ImageCat, Inc., where he oversees a team of engineers, scientists, and programmers developing software tools and data processing algorithms for loss estimation and risk reduction. He has over 13 years of experience in GIS analysis and application development. He introduced GIS and Remote Sensing to EQE International, where he served as GIS Programmer Analyst on several loss estimation and research projects. With the emergence of GIS and remote sensing as vertical markets in insurance, he served as a key GIS and remote sensing technical advisor. At the California Governor’s Office of

xxxii

Author Biographies

Emergency services, he was responsible for geographic and statistical analysis, database development, and mapping disaster information under intense time constraints. He also responded to the Northridge Earthquake, California Winter Storms, and California Fire Storms. He has contributed to the development of several GIS software programs for emergency management, real estate, and insurance industries, which include: the HAZUS flood module, EPEDAT, J-EPEDAT, EPEDAT-LA, USQuake, RAMP, U-RAMP, REDARS, Bridge Hunter/Bridge Doctor, VRS, VIEWS, INLET, GeoVideo, MIHEA, 3D-Cube, RT MapViewer and BETTERDEMS. Application development environments used include: ArcObjects, MapObjects, ArcView/Avenue, MapInfo/MapBasic, ArcIMS, UMN MapServer, MapBasic, and ENVI/IDL. Databases used in a programming environment include SQL Server, DB2, Oracle and Access. Some of the specific projects for which Mr. Huyck has been the primary GIS or remote sensing analyst include: an advanced HAZUS-based risk analysis of the State of South Carolina, automated damage detection from satellite imagery following the Marama, Turkey (1999), Boumerdes, Algeria (2003), and Bam, Iran (2004) earthquakes; an assessment of the use of remote sensing and GIS after September 11th; various studies on the economic impacts of earthquakes on utility and transportation systems; and the extraction of GIS building inventories from optical and radar data. He has authored over 50 papers pertaining to GIS, remote sensing, and emergency management. Brian A. Jackson is associate director of RAND’s Homeland Security research program. His terrorism-focused research has examined tactical and operational learning by terrorist groups, terrorist groups’ use of technology, projects developing approaches to assess the threat posed by potential terrorist use of specific weapons technologies, examination of the strategies to respond to terrorist targeting of national economies, development of terrorist attack scenarios to support policy analysis efforts, and a large-scale study emergency responder protection during responses to major disasters and terrorist attacks. Key publications in these areas include articles in Studies in Conflict and Terrorism and Military Review on technology adoption by terrorist organizations, terrorist organizational structures and behavior, and intelligence gathering for targeting terrorist and insurgent groups, as well as the RAND reports Aptitude for Destruction, Volumes 1 & 2, examining organizational learning in terrorist groups, Breaching the Fortress Wall: Understanding Terrorist Efforts to Overcome Defensive Technologies, and Volumes 1 and 3 of the RAND Protecting Emergency Responders series of publications. Brian holds a Ph.D. in bioinorganic chemistry from the California Institute of Technology and a Master's degree from George Washington University in Science, Technology, and Public

Author Biographies

xxxiii

Policy. Matthew Jensen is a post-doctoral researcher at the University of Arizona. He received his PhD from the University of Arizona. His research focuses on computer-aided decision making, knowledge-based systems, and automatic deception detection. He has published in IEEE Intelligent Systems, and in numerous conference proceedings. Jean-Paul Jéral is a senior researcher within the “Support to External Security” Unit at the JRC’s “Institute for the Protection and the Security of the Citizen” in Ispra, Italy. With a backgrounds in information technology, he is presently carrying our research on information processing, based on a media monitor system (Europe Media Monitor-EMM) developed at the JRC. Research results are meant to support EU policy-makers in the field of security and terrorism. Dmitri V. Kalashnikov received his Ph.D. degree in computer science from Purdue University in 2003, and his diploma cum laude in applied mathematics and computer science from Moscow State University, Russia, in 1999. Currently, he is a research faculty member in the University of California at Irvine. He has received several scholarships, awards, and honors, including an Intel Ph.D. Fellowship and Intel Scholarship. His research interests are in several areas including large-scale data management, information quality and data cleaning, moving-object and spatio-temporal databases, and IT technology for crisis response management. Abraham Kandel received a B.Sc. from the Technion – Israel Institute of Technology, a M.S. from the University of California, both in Electrical Engineering, and a Ph.D. in Electrical Engineering and Computer Science from the University of New Mexico. Dr. Kandel, a Distinguished University Research Professor and the Endowed Eminent Scholar in Computer Science and Engineering at the University of South Florida, is the Executive Director of the National Institute for Applied Computational Intelligence. He was the Chairman of the Computer Science and Engineering Department at the University of South Florida (1991-2003) and the Founding Chairman of the Computer Science Department at Florida State University (19781991). Dr. Kandel has published over 500 research papers for numerous professional publications in Computer Science and Engineering. He is also the author, co-author, editor or co-editor of 46 text books and research monographs in the field. Dr. Kandel is a Fellow of the ACM, Fellow of the IEEE, Fellow of the New York Academy of Sciences, Fellow of AAAS,

xxxiv

Author Biographies

Fellow of IFSA, as well as a member of NAFIPS, IAPR, ASEE, and SigmaXi. John Kruse is a Lead Information Systems Engineer with the MITRE Corporation. Previously he was the Director of Systems Development at the University of Arizona 's Center for the Management of Information. His primary field of interest is the development of collaborative systems for decision making. In pursuit of this, he has worked extensively in the field of military decision support and network-centric operations. Additionally, Dr. Kruse has been working to develop prototype systems for automated intent and deception detection. He has worked extensively with a wide range of educational, governmental and military groups to help develop group processes and software that support collaborative work. Mark Last received his M.Sc. (1990) and Ph.D. (2000) degrees in Industrial Engineering from Tel Aviv University, Israel. He is currently a Senior Lecturer at the Department of Information Systems Engineering, Ben-Gurion University of the Negev, Israel. Mark Last has published over 110 papers and chapters in scientific journals, books, and refereed conferences. He has been a co-author of the monographs “Knowledge Discovery and Data Mining – The Info-Fuzzy Network (IFN) Methodology” (Kluwer 2000) and "Graph-Theoretic Techniques for Web Content Mining" (World Scientific, 2005) and a co-editor of six volumes including "Fighting Terror in Cyberspace" (World Scientific, 2005). His current research interests include data mining, text mining, and cyber intelligence. Mark Last is an Associate Editor of IEEE Transactions on Systems, Man, and Cybernetics - Part C and a Senior Member of the IEEE Computer Society. Elizabeth Liddy is a Professor in the School of Information Studies at Syracuse University and Director of its Center for Natural Language Processing where she leads a team of researchers focused on developing human-like language-understanding software technologies. Liddy has successfully applied natural language processing to various information access technologies including information extraction, information retrieval, data-mining, question-answering, cross-language retrieval, 2-stage webbased retrieval and automatic metadata generation. Liddy’s research agenda has been continuously supported by both government and corporate funders on a total of 65 projects. Dr. Ee-Peng Lim received his Ph.D. from the University of Minnesota. He is currently the Head of Division of Information Systems in

Author Biographies

xxxv

the School of Computer Engineering of the Nanyang Technological University. Dr Lim’s research interests include information integration, data/text/web mining, digital libraries, and wireless intelligence. His papers appeared at ACM Transactions on Information Systems (TOIS), IEEE Transactions on Knowledge and Data Engineering (TKDE), Data and Knowledge Engineering (DKE), and other major journals. He is currently an Associate Editor of the ACM Transactions on Information Systems (TOIS), Journal of Web Engineering (JWE), International Journal of Digital Libraries (IJDL) and International Journal of Data Warehousing and Mining (IJDWM). Sharad Mehrotra is a Professor of Computer Science at the University of California, Irvine. He is the Director of the 5-year NSF large-ITR project RESCUE on advancing information technologies for disaster response. His interests and expertise span many areas in data management and distributed systems. He received a PhD in Computer Science from the University of Texas at Austin in 1993. Thomas O. Meservy is an Assistant Professor of Management Information Systems at the University of Memphis. He received his PhD from the University of Arizona. His research focuses on using technology to automatically detect deception in audio and video. He has published in IEEE Computer, IEEE Intelligent Systems, and a variety of conference proceedings. Dr. Jay F. Nunamaker, Jr. is Regents and Soldwedel Professor of MIS, Computer Science and Communication and Director of the Center for the Management of Information at the University of Arizona, Tucson. Dr. Nunamaker received the LEO Award from the Association of Information Systems (AIS) at ICIS in Barcelona, Spain, December 2002 for a lifetime of exceptional achievement in information systems. He founded the MIS department at the University of Arizona, in 1974 and served as department head for 18 years. Dr. Nunamaker received his Ph.D. in systems engineering and operations research from Case Institute of Technology, an M.S. and B.S. in engineering from the University of Pittsburgh, and a B.S. from Carnegie Mellon University. He received his professional engineer’s license in 1965. Jialun Qin is an Assistant Professor in the Department of Management at University of Massachusetts Lowell. He received his Ph.D. degree in management information systems from the University of Arizona. His research interests include knowledge management, data and Web mining,

xxxvi

Author Biographies

digital libraries, and human computer interaction. His publications have appeared in Decision Support Systems, Journal of the American Society for Information Science and Technology, and IEEE Intelligent Systems. Sam Raphael is a Teaching Fellow at the Defence Studies Department (DSD), which is part of the Joint Services Command and Staff College (JSCSC), Shrivenham, UK. Here, he delivers academic support to serving members of the UK armed forces on a wide variety subjects connected to ‘security studies’. He is also a Visiting Lecturer at the University of East London (UEL), delivering lectures on the UK’s only Master’s-level degree course on terrorism studies. Sam is completing a doctoral thesis at the Department of War Studies, King’s College London (KCL). His research is examining the ‘knowledge’ generated by key figures in the field of terrorism studies, in order to test the hypothesis that this body of work is politically biased. Peter D. Rumm, M.D., M.P.H, F.A.C.P.M is a Deputy Director of the Division of General, Neurological and Restorative Devices for the Food and Drug Administration, US. DHHS. Dr. Rumm graduated from the Medical College of Georgia and received his MPH from the University of Washington, concentrating in health services administration. He is a Fellow of the American College of Preventive Medicine and was granted advanced standing in the American College of Physician Executives. Dr. Rumm’s career was “profiled” in a workshop on career choices at the 2003 American College of Preventive Medicine Physicians Meeting “as an example to young physicians in this field”. Dr Rumm was formerly a Chief Medical Officer and State Epidemiologist in the Wisconsin Division of Public Health. He worked in the broad area of chronic disease, terrorism prevention, patient safety, health promotion and health policy and directed a statewide committee on terrorism assessments and preparedness. Marc Sageman is an independent researcher on terrorism and is the founder and principal of Sageman Consulting LLC in Rockville, Maryland. Dr. Sageman is a senior fellow at the Foreign Policy Research Institute in Philadelphia, Pennsylvania, and a senior associate at the Center for Strategic and International Studies in Washington, D.C. He graduated from Harvard University in 1973, and earned an M.D. and a Ph.D. in political sociology from New York University. He is the author of bestselling books including Understanding Terror Networks and Leaderless Jihad. Arab Salem received his Masters in Science in Management Information Systems (2006) from the University of Arizona. His current

Author Biographies

xxxvii

research interests include content analysis, multimedia analysis and software design. Dr. Moti Schneider received his Ph.D. in 1986 from the Florida State University. He is a member of the school of computer science at Netanya Academic college. His area of expertise include: Artificial Intelligence, Expert Systems, Data Mining, Fuzzy Logic, Nueral Networks, Image Processing, Pattern Recognition. He published over 120 refereed papers and books. Young-Woo Seo received his B.S. in Computer Science from Konkuk University and M.S. in Computer Science from Seoul National University. He is currently a Ph.D. student at the Robotics Institute of Carnegie Mellon University. His research interests include statistical machine learning, multiagents system, and behavior control for mobile robot. Before joining the PhD program, he worked on various research projects of developing intelligent software agents. Yael Shahar heads the database project at Institute for CounterTerrorism at the Interdisciplinary Center Herzliya. Her areas of expertise include technological trends in terrorism, terrorism informatics, datamining, and intelligence sharing She designed the ICT terrorist connections database and the terrorist incidents database, used for tracking links between terrorist individuals, front companies, and organizations. Ms. Shahar specializes in the study of technological trends as applied to terrorism and intelligence sharing. She lectures on terrorism trends, non-conventional terrorism, and threat assessment at the International Policy Institute for Counter Terrorism, Interdisciplinary Center Herzliya, as well as security conferences and seminars worldwide. Ms. Shahar’s primarily responsibility is conducting open-source datamining in support of ICT research projects, as well as venue-specific threat assessments for ICT’s commercial clients. Her background is in physics, database design, and security and installation protection. She served as a reservist in the IDF hostage rescue unit, and as a sniper in Israel’s Border Guard “Matmid” units. Dr. Bracha Shapira is currently a Senior Lecturer at the Department of Information Systems Engineering in Ben-Gurion University of the Negev in Israel. She holds an M.Sc. in computer science from the Hebrew University in Jerusalem and a Ph.D. in Information Systems from Ben-Gurion University. Bracha’s research interests include Information Retrieval (IR) and Information Filtering (IF), privacy and user modeling. Bracha leads theoretical and empirical studies that make significant contribution in the mentioned domains. Bracha's numerous articles have been published in

xxxviii

Author Biographies

refereed Journals (such as JASSIST, DSS, IP&M, CACM). Her work was also presented at many professional conferences. Before turning to the academic world she gained professional experience while working as a system engineer and managing programming teams for telecommunication companies developing real-time applications. David Skillicorn is a Professor in the School of Computing at Queen's University in Canada. His research is in smart information management, both the problems of extracting and sharing useful knowledge from data, and the problems of accessing and computing with large datasets that are geographically distributed. He has published extensively in highperformance computing and data mining. At present his focus is on understanding complex datasets in applications such as astrophysics, geochemistry, network intrusion, fraud detection, and counterterrorism. He has an undergraduate degree from the University of Sydney and a Ph.D. from the University of Manitoba. Padhraic Smyth is a Professor in the School of Information and Computer Science, University of California, Irvine. He is currently also a member of the Institute for Mathematical Behavioral Sciences, the Institute for Genomics and Bioinformatics, and the Center for Biomedical Engineering (all at UC Irvine). Dr. Smyth's research interests include machine learning, data mining, statistical pattern recognition, applied statistics, and information theory. He was a recipient of best paper awards at the 2002 and 1997 ACM SIGKDD Conferences, an IBM Faculty Partnership Award in 2001, a National Science Foundation Faculty CAREER award in 1997 and the Lew Allen Award for Excellence in Research at JPL in 1993. He is co-author of Modeling the Internet and the Web: Probabilistic Methods and Algorithms (with Pierre Baldi and Paolo Frasconi), published by Wiley in 2003. He is also co-author of a graduate text in data mining, Principles of Data Mining, MIT Press, August 2001, with David Hand and Heikki Mannila. He was co-editor of Advances in Knowledge Discovery and Data Mining, published by MIT Press in 1996. He is currently an associate editor for the Journal of the American Statistical Association and, for the IEEE Transactions on Knowledge and Data Engineering, has served as an action editor for the Machine Learning Journal. He is also a founding associate editor for the Journal of Data Mining and Knowledge Discovery, and a founding editorial board member of the Journal of Machine Learning Research. He served as program chair for the 33rd Symposium on Computer Science and Statistics in 2001 and served as general chair for the Sixth International Workshop on AI and Statistics in 1997. He received a first class honors degree in Electronic

Author Biographies

xxxix

Engineering from University College Galway (National University of Ireland) in 1984, and the MSEE and PhD degrees from the Electrical Engineering Department at the California Institute of Technology in 1985 and 1988 respectively. From 1988 to 1996 he was a Technical Group Leader at the Jet Propulsion Laboratory, Pasadena, and has been on the faculty at UC Irvine since 1996. Zhen Sun is a graduate student at the School of Computer Engineering, Nanyang Technological University. His research interests include information retrieval and data mining. Maggy Anastasia Suryanto is a graduate student at the School of Computer Engineering, Nanyang Technological University. She is currently pursuing her PhD under the supervision of Dr Ee-Peng Lim. Her research interests include question answering and information retrieval. Katia Sycara is a Professor in the Robotics Institute, School of Computer Science at Carnegie Mellon University and the Director of the Laboratory for Agents Technology and Semantic Web Technologies. She holds a B.S in Applied Mathematics from Brown University, M.S. in Electrical Engineering from the University of Wisconsin and PhD in Computer Science from Georgia Institute of Technology. She holds an Honorary Doctorate from the University of the Aegean (2004). She is a member of the Scientific Advisory Board of France Telecom, and a member of the Scientific Advisory Board of the Greek National Center of Scientific Research “Demokritos” Information Technology Division. She is a Fellow of the American Association for Artificial Intelligence (AAAI), Fellow of the IEEE and the recipient of the 2002 ACM/SIGART Agents Research Award. Prof. Sycara has served as General Chair and Program Chair of multiple conferences, has given numerous invited talks, has authored more than 300 technical papers dealing with Multiagent Systems, Negotiation, Software Agents, Agent Teams, Web Services, the Semantic Web, and Human-Agent-Robot Teams. She has led multimillion dollar research effort funded by DARPA, NASA, AFOSR, ONR, AFRL, NSF and industry. She is a founding member and member of the Board of Directors of the International Foundation of Multiagent Systems (IFMAS). She is a founding member of the Semantic Web Science Association, and serves as the US co-chair of the Semantic Web Services Initiative. She is a founding Editor-in-Chief of the journal “Autonomous Agents and Multiagent Systems” and is currently serving on the editorial board of 5 additional journals.

xl

Author Biographies

Svetlana Symonenko is a PhD candidate with the School of Information Studies at Syracuse University, New York. Her research interest is in the organization of Web-based information for better access. Symonenko’s ongoing dissertation research explores indications of conventionalization in the observable structure of website content. Her dissertation proposal recently received the Thomson ISI Doctoral Dissertation Proposal in 2005. She works as a research assistant at the Center for Natural Language Processing at Syracuse University. Symonenko received her MLIS degree from St. John’s University, New York. Horacio R. Trujillo is a research fellow at the RAND Corporation and an adjunct professor in the Department of Diplomacy and World Affairs at Occidental College. At RAND, Horacio’s work focuses on the intersection of international economics and security, spanning from research on the organizational dynamics of terrorist groups to efforts to adapt and develop various analytical methods to aid in the assessment and improvement of complex national economic and security strategies. Prior to joining RAND, Horacio worked with a number of national and multilateral institutions, including the U.S. Congress, the World Bank, and the United Nations. Horacio is a graduate of Georgetown University’s School of Foreign Service, and holds advanced degrees from Oxford University’s International Development Center and Stanford University’s Graduate School of Business. Nalini Venkatasubramanian received the M.S. and Ph.D. in Computer Science from the University of Illinois, Urbana-Champaign. She is an associate professor at the School of Information and Computer Science, University of California, Irvine. Her research interests include distributed and parallel systems, middleware, mobile environments, multimedia systems/applications and formal reasoning of distributed systems. She is specifically interested in developing safe and flexible middleware technology for highly dynamic environments. Nalini was a member of technical staff at Hewlett-Packard Laboratories in Palo Alto, California for several years where she worked on large scale distributed systems and interactive multimedia applications. She has also worked on various database management systems and on programming languages/compilers for high performance machines. She is a member of the IEEE and ACM. Daniel D. Wu received the BS degree in Biochemistry from Xiamen University in China, MS in Physiology (1996) and MS in Computer Science (2001) from the Pennsylvania State University. He is currently pursuing the PhD degree in the College of Information Science and Technology at Drexel

Author Biographies

xli

University. His research interests are in data mining, bioinformatics, and biomolecular network analysis. Jennifer J. Xu is an assistant professor of Computer Information Systems at Bentley College. She received her PhD in Management Information Systems from the University of Arizona in 2005. Her current research interests include knowledge management, social network analysis, virtual community, human-computer interaction, and information visualization. Her papers have appeared in Communications of the ACM, ACM Transactions on Information Systems, and Annual Review of Information Science and Technology. Shuting Xu received her Ph.D. in Computer Science from The University of Kentucky in 2005. She is presently an Assistant Professor in the Department of Computer Information Systems at the Virginia State University. Her research interests include data mining and information retrieval, information security, database systems, parallel and distributed computing. Ozgur Yilmazel is an Assistant Research Professor in the School of Information Studies at Syracuse University and the Chief Software Engineer of its Center for Natural Language Processing, research center. His research interests include machine learning applications for natural language processing, question answering and the use of complex linguistic features for text applications such as text categorization and information retrieval. Yilmazel received his Ph.D. and M.Sc. from Syracuse University, Electrical Engineering in 2006 and 2002. Omer Zaafrany received his B.Sc. degree in Information Systems Engineering from Ben-Gurion University of the Negev in 2002. He is currently a Master’s student in the same department. Omer has about 10 publications in professional journals and conferences. His current research interests include data mining, information retrieval, and information warfare. Jun Zhang received his Ph.D. from The George Washington University in 1997. He is a Professor of Computer Science and Director of the Laboratory for High Performance Scientific Computing & Computer Simulation and Laboratory for Computational Medical Imaging & Data Analysis at the University of Kentucky. His research interests include computational neuroinformatics, data mining and information retrieval, large scale parallel and scientific computing, numerical simulation, iterative

xlii

Author Biographies

and preconditioning techniques for large scale matrix computation. Dr. Zhang is an associate editor and on the editorial boards of five international journals, and is on the program committees of a few international conferences. His research work has been funded by the National Science Foundation, Department of Energy, Kentucky Science and Engineering Foundation, and Alzheimer's Association. He is recipient of the U.S. National Science Foundation CAREER Award and several other awards. Xiaodan Zhang, PhD student at College of Information Science and Technology, Drexel University, USA. He has a master degree in computer science and a bachelor degree in library and information science. He has been working on graph-based, model-based and semantic based text data mining. Xiaohua Zhou is a PhD student at College of Information Science and Technology, Drexel University, USA. His current research interests are in information retrieval and text mining. He is the author or co-authros of 17 peer-reviewed publications in various journal, conference and books. Dr. Yilu Zhou is an assistant professor in the Department of Information Systems and Technology Management at George Washington University. Her current research interests include multilingual knowledge discovery, Web mining, text mining and human computer interaction. She received her Ph.D. in Management Information Systems from the University of Arizona, where she was also a research associate at the Artificial Intelligence Lab. She received a B.S. in Computer Science from Shanghai Jiaotong University. She has published in IEEE Intelligent Systems, Decision Support Systems, and Journal of the American Society for Information Science and Technology.

Unit 1

METHODOLOGICAL ISSUES IN TERRORISM RESEARCH

1 DOMAIN MAPPING OF CONTEMPORARY TERRORISM RESEARCH

Edna Reid1 and Hsinchun Chen2 1

Department of Library Science, Clarion University, Clarion, Pennsylvania, U.S.A.([email protected]); 2MIS Department, University of Arizona, Tucson, Arizona, U.S.A.([email protected])

CHAPTER OVERVIEW Mapping a domain involves mining, analyzing, charting, and visualizing a research area according to experts, institutions, topics, publications, and social networks. This chapter presents an overview of contemporary terrorism research by applying domain visualization techniques to the literature and author citation data from the years 1965 to 2003. The data were gathered from ten databases such as the ISI Web of Science then analyzed using an integrated knowledge mapping framework that includes selected techniques such as self-organizing map (SOM), content map analysis, and co-citation analysis. The analysis revealed (1) 42 key terrorism researchers and their institutional affiliations; (2) their influential publications; (3) a shift from focusing on terrorism as a low-intensity conflict to an emphasis on it as a strategic threat to world powers with increased focus on Osama Bin Laden; and (4) clusters of terrorism researchers who work in similar research areas as identified by co-citation and block-modeling maps.

3

4

1.

Chapter 1. Reid and Chen

INTRODUCTION

Contemporary terrorism is a form of political violence that evolved in the 1960s and characterized by an increase in terrorist attacks across international boundaries [36]. The recent escalation of contemporary terrorism has attracted many new and non-traditional research communities such as information science and human factors, whose scholars have a desire to do research in this area. This raises questions for new terrorism researchers as they try to adapt to the challenges in this domain “Who are the leading researchers in terrorism?” “What are their relevant publications?” “What are the dominant topics because I want to know if my ideas have already been explored?” “What types of data are used?” “Who should I work with?” The task of responding to these questions is difficult because of the explosive growth in the volume of terrorism publications, the interdisciplinary and international nature of the field, and the lack of a professional association to nurture the terrorism research area and provide a platform for organizing and providing systematic access to terrorism studies [15;27]. For example, terrorism information is spread across many electronic databases, government and research center’s websites, and a large number of journals that deal with various specialized aspects of the phenomenon [16]. This work extends a prior effort using a manually-driven bibliometric approach to examine terrorism research and offers another view of the intellectual field of terrorism [26]. Bibliometrics is the quantitative study of the literature and scholarly communication processes in a field [3]. With the interest in terrorism increasing, the findings of this study will be immensely useful in understanding the contributions of key terrorism authors in guiding terrorism-related research. This paper presents a brief review of analytical techniques and framework for knowledge mapping. Subsequent sections will describe the research design and results of our contemporary terrorism literature mapping with three types of analysis: basic analysis, content map analysis, and cocitation network analysis. The final section will provide conclusion.

2.

RELATED WORK

There is extensive literature on knowledge mapping of scholarly literature and patents to analyze the structure, the dynamics, social networks, and development of a field such as medical informatics and information science [5;14;17;33]. Mapping refers to an evolving interdisciplinary area

1. Domain Mapping of Contemporary Terrorism Research

5

of science aimed at the process of charting, mining, analyzing, sorting, enabling navigation of, and displaying knowledge [32]. Although it is useful to the subject expert for validation of perceptions and means to investigate trends, it provides an entry point into the domain and answers to domainspecific research questions for the non-expert [5].

2.1

Citation Data

Maps and snapshots of a field’s intellectual space have been generated as a result of the pioneering work of Garfield and Small who stimulated widespread interest in using aggregated citation data to chart the evolution of scientific specialties [10]. By aggregating citation data, it is possible to identify the relative impact of individual authors, publications, institutions, and highlight emerging specialties, new technologies and the structure of a field [13]. The advent of citation databases such as the Institute for Scientific Information (ISI) Social Sciences Citation Index (SSCI) and Science Citation Index (SCI), which track how frequently papers are cited in a publication, and by whom, have created tools for indicating the impact of research papers, institutions, and authors [13]. The web-version of SSCI, SCI, and the Arts and Humanities Citation Index is the Web of Science (WoS). Web-based tools such as Google and ResearchIndex (formerly CiteSeer) have been created to harness the similarities between citation linking and hyperlinking [10;30]. Searching the digital citation indexes have resulted in enormous amounts of citation data that are difficult to analyze, extract meaningful results, and display using traditional techniques. This was illustrated in earlier citation network studies of terrorism researchers in which Reid [26;27;28] used authors, institutions, and documents as units of analysis and the ISI databases to identify the invisible colleges (informal social networks) of terrorism researchers, key research institutions, and their knowledge discovery patterns. This manual process was labor-intensive and relied on citation data. While there are limitations in using the ISI citation data such as they are ‘lagging indicators’ of research that has already been completed and passed through the peer review cycle [13], they are widely used in visualization studies and are the basis for identifying key terrorism researchers, influential publications, and subgroups of terrorism researchers in this study.

2.2

Visualization Techniques

Recent developments in the field of domain visualization attempt to alleviate this “citation information overload problem” by applying

6

Chapter 1. Reid and Chen

information visualization techniques to interact with large-scale citation data [11]. Several techniques have been applied to citation visualization such as Pathfinder network scaling [7], social network analysis, and author cocitation analysis [33;4] which is particularly suited to investigation of intellectual structure because they provide the capability to interact with data and display it from different perspectives. Author co-citation map identifies interrelation among authors by analyzing the counts of the number of articles that cite pairs of authors jointly [34]. Content, or ‘semantic’, analysis is an important branch of domain analysis which relies on natural language processing techniques to analyze large corpora of literature [11]. The content map analysis technique produces content maps of large-scale text collections. The technique uses simple lexical statistics, key phrase co-occurrence analysis, and semantic and linguistic relation parsing. For example, Huang, et.al. [17] uses selforganizing map (SOM) algorithm to generate content maps for visualizing the major technical concepts appearing in the nanotechnology patents and their evolution over time. Another visualization technique is block-modeling which seeks to cluster units that have substantially similar patterns of relationships with others [12]. It has been applied in criminal network analysis to identify interaction patterns between subgroups of gang members [8]. The application of visualization techniques to citation, content analysis, and author co-citation data provides a foundation for knowledge mapping. The techniques support the users’ visual exploration of a domain to identify emerging topics, key researchers, communities, and other implicit knowledge that is presently known only to domain experts [32]. For example, the Namebase [25], mines names and organizations from terrorism books and periodicals included in its database and links names in a social network. Figure 1-1 provides an example of a terrorism social network for Brian M. Jenkins (name listed in the center in red), founder of terrorism research at Rand Corporation. It is based on the number of times a name is listed on the same page with Jenkins. Although the Namebase visualization does not indicate whether there is a relationship between Jenkins and the other names listed on the page or the context of their relationships, it is the only web-based tool readily available for visualizing social networks of terrorism researchers. Additionally, no systematic study has been conducted that uses citation network, content map analysis, and author co-citation analysis for automatically mapping the terrorism research domain.

7 1. Domain Mapping of Contemporary Terrorism Research

Figure 1-1. Brian Jenkins’s Social Network (a) and detail (b; for legibility) (http://www.namebase.org)

8

3.

Chapter 1. Reid and Chen

RESEARCH DESIGN

This study purports to provide empirically based answers to the research questions (RQs) listed in Table 1-1. It adopts the integrated knowledge mapping framework proposed by Huang [17] for patent analysis and used in Eggers study of medical informatics [11]. The framework includes three types of analysis: basic analysis, content map analysis, and citation network analysis to provide a multifaceted analysis of a research domain. For the basic analysis, we analyze scientific output measures such as productivity (number of publications produced by a terrorism researcher) and impact (citation counts which allows one to find out how often a publication is cited). By analyzing documents and citation information, we identify key researchers, their influential terrorism publications, and research communities. The content map analysis visualizes the major subtopics and emerging concepts appearing in the publications while the co-citation map measures linkages and similarities among pairs of terrorism researchers as identified by citers. The co-citation data were also used in block-modeling to identify interaction patterns between subgroups of researchers within the terrorism scientific paradigms. Table 1-1. Knowledge Mapping Framework and Research Questions Type of Analysis Unit of Analysis Measure Research Questions (RQs) § Who are key terrorism Basic analysis § Authors Productivity § Publications researchers? Impact § What institutions are they § Publication’s affiliated with? citations § What are their influential terrorism publications? § What are their collaboration patterns? Coverage Content analysis § Documents § What are the dominant § Words terrorism topics? § What are the new areas of research? § Author’s coLinkage § What groups of authors Co-citation analysis citations have papers with related content? § What are the communities of researchers?

3.1

Basic Analysis

For the basic analysis, the initial step is to identify a set of key terrorism authors. We compiled a list of authors from several sources: terrorism publications [31;28], active terrorism experts identified by the KnowNet

1. Domain Mapping of Contemporary Terrorism Research

9

virtual community (organized by the Sandia National Laboratories), and terrorism research center portals identified on the Internet. A total of 131 unique names were identified. Names are for researchers primarily from think tanks, academic institutions, and governments located in 13 countries including UK (18), Israel (7), and France (5). Sixty-four percent are from the United States. The second step in the basic analysis is to identify the researchers’ terrorism publications. A bibliography of English-language terrorism publications was compiled for each researcher using commercial databases. The publications include journal articles, books, book chapters, reviews, notes, newspaper articles, conferences papers, and reports. Table 1-2 lists the ten commercial databases that were searched using author’s name and terrorism-related keywords such as terrorism, hijacking, bombing, political violence, or bombing. The commercial databases were selected because of subject coverage and availability through the University of Arizona (UA) Library. Bibliographical data and abstracts were downloaded, parsed and imported into a database for additional processing. After purging duplicate records, 2,148 bibliographic records were manually reviewed to identify other records that may be duplicates (non-obvious) or non-terrorism publications. Database searches for 22 researchers failed to retrieve any terrorism-related publications while no English publications were retrieved for 21 other recommended researchers. As a result, terrorism publications (bibliographic data and abstracts) were retrieved for only 88 researchers. Table 1-2. Databases Used to Compile Bibliographies Database Discipline ABI/Inform Business, management, information sciences Academic Search Premier (ASP) Multi-disciplinary Expanded Academic ASAP (EA) Multi-disciplinary International Biblographie der International, European Zeitschriften Literature (IBZ) ISI Web of Science Social sciences, science, arts & humanities PAIS International Public affairs, business, social studies, international relations, economics Political Science Abstracts (PSA) Political science, international, politics Science Direct Science, technology, medicine Sociological Abstracts Sociology, family studies WorldCat (materials cataloged by Multi-disciplinary libraries around the world) Total

Records Exported 164 496 439 161 360 588

539 9 279 1,154 4,129

10

Chapter 1. Reid and Chen

The third step is to identify key terrorism researchers from the group of 88 researchers. The publications of the 88 terrorism researchers were analyzed using basic citation analysis to identify how frequently these are cited in the literature. Basic citation counts for each terrorism-related publication for each terrorism researcher were collected from the ISI Web of Science. Citations to each publication from any other article in the ISI dataset are counted, and each indexed author is credited with the full tally of citations to that article [20]. If an author’s total number of citations for a publication in our collection is four or more then he is considered a key terrorism researcher. After an author is identified as a key researcher, his terrorism-related publication with the highest citation count is considered as his influential publication In addition, a coauthorship network was created to identify the collaboration patterns among the authors. The network covered the years 1965-2003. A hierarchical clustering algorithm was used to partition the core researchers who are connected if they coauthored a paper [37]. This allows for visualization of collaboration, research teams, and institutions.

3.2

Content Map Analysis

The influential terrorism researchers’ bibliographic data and abstracts were used in a content map analysis to identify the dominating themes and terrorism topics in 1965-2003. Since we want to examine more than simple frequency counts, we applied our previous research in large-scale text analysis and visualization for content map technology to identify and visualize major research topics. The key algorithm of our content mapping program was the self-organizing map (SOM) algorithm developed in our lab [Huang]. It takes the terrorism titles and abstracts as inputs and provides the hierarchical grouping of the publications, labels of the groups, and regions of the terrorism document groups in the content map. Conceptual closeness was derived from the co-occurrence patterns of the terrorism topics. The sizes of the topic regions also generally corresponded to the number of documents assigned to the topics [23].

3.3

Co-citation Analysis

Author co-citation analysis was used to visualize the similarities among the researchers and their intellectual influence on other authors. It uses authors as the units of analysis and the co-citations of pairs of author (the number of times they are cited together by a third party) as the variable that indicates their distances from each other [1]. It was conducted based on cocitation frequencies for the key terrorism researchers, for the period 1965-

1. Domain Mapping of Contemporary Terrorism Research

11

2003. The co-citation map was created using a GIS algorithm developed in our lab. We conducted terrorism keyword searches in the Web of Science to retrieve records related to the topic of terrorism. The records were used to create a terrorism citation collection and included bibliographic records for 7,590 terrorism-related articles that were downloaded. Results were parsed and loaded into a database which was used for the co-citation analysis. Table 1-3 summarizes the data sets used for this study. Table 1-3. Data Sets Summary Data Web of Science (terrorism keyword searches) Publications 7,590 Authors 6,090 Cited References 67,453 Cited Authors 32,037

10 Bibliographic Databases (author & keyword searches) 4,129 1,168 Not retrieved Not retrieved

Co-citation counts for each key terrorism researchers were derived using a program created by our lab. The program searched the citation field of each bibliographic record and counted the number of times two authors (or author pairs) were cited together. The result was the basis of the co-citation analysis portion of this study and offered a mapping of the field of terrorism research and the intellectual influence of the core researchers. Visualization of the relationships among researchers was displayed in a two-dimensional map that identifies their similarities, communities (clusters), and influence on emerging authors. The co-citation data were also used in block-modeling to identify researchers’ roles and positions in the terrorism research network. We used co-occurrence weight to measure the relational strength between two authors by computing how frequently they were identified in the same citing article [7]. We also calculated centrality measures to detect key members in each subgroup, such as the leaders [8]. The block-modeling algorithm is part of the social network analysis program developed in our lab.

4.

RESULTS

4.1

Basic Analysis

The basic analysis provides responses to the initial set of questions identified in Table 1-1 such as who are the key terrorism researchers. Fortytwo authors were identified as key terrorism researchers. A total of 284 researchers (including coauthors) and their 882 publications made up the sample for this study.

12

Chapter 1. Reid and Chen

Table 1-4 lists the 42 key researchers, the number of terrorism publications in our dataset, and the number of times the researchers’ publications were cited in the ISI databases. They are mainly affiliated with academic institutions (23), think tanks (15), media organizations (3), and the government (1). Their bases of operation are located in nine countries including the US (29), UK (4), and Ireland (1). Table 1-4. Forty-two Key Terrorism Researchers (based on citation score in ISI) Author Name # of # Times Author Name # of Pubs* # Times Pubs* Cited Cited 1. Wilkinson, Paul 87 229 22. Lesser, Ian O. 5 23 2. Gurr, T.R. 51 214 23. Bassiouni, 8 22 M.C. 3. Laqueur, Walter 37 191 24. Carlton, David 1 21 4. Alexander, 88 169 25. Chalk, Peter 17 20 Yonah 5. Bell, J.B. 47 138 26. Freedman, 14 20 Lawrence 6. Stohl, M. 30 136 27. Merari, Ariel 25 19 7. Hoffman, 121 100 28. Post, Jerrold 12 18 Bruce 8. Jenkins, Brian 38 96 29. Evans, Ernest 3 17 M. H. 9. Ronfeldt, David 20 95 30. Bergen, Peter 10 16 10. Crenshaw, 40 90 31. Gunaratna, 14 16 Martha Rohan 11. Arquilla, John 20 75 32. Cline, R.S. 8 15 12. Mickolus, 25 73 33. Friedlander, 4 14 Edward F. R.A. 13. Crelinsten, 19 62 34. Paust, Jordon J. 11 13 Ronald 14. Schmid, Alex 6 59 35. Ranstorp, 8 13 P. Magnus 15. Wardlaw, G. 25 49 36. Flynn, Stephen 4 12 E 16. Hacker, F.J. 3 38 37. Cooper, H.H.A 10 11 17. Rapoport, 26 37 38. Wolf, J.B 7 11 David 18. Sloan, Stephen 31 30 39. Horgan, John 13 10 R 19. Dobson, C. 6 25 40. Sterling, C. 5 10 20. Kepel, Gilles 6 25 41. McCauley, 4 8 Clark 21. Stern, Jessica E 21 25 42. Merkl, Peter 6 6 * number of publications in our dataset

The Appendix lists the most influential publication for each researcher

1. Domain Mapping of Contemporary Terrorism Research

13

which is based on the number of times cited in the ISI Web of Science. Table 1-5 lists the 12 most influential publications because they were cited more than twenty-five times in ISI databases. Table 1-5. Most Influential Terrorism Publications Publication # Times Topic cited 1. Why men rebel, 1970 145 political violence 2. Terrorism, 1977 75 terrorism historical aspects

Author

Organization

Gurr, Ted

Univ Maryland Center for Strategic & Intl Studies (CSIS) Univ Aberdeen (formerly), CSTPV Rand Corporation CIA (formerly) USC Medical & Law Schools Columbia Univ Purdue Univ

Laqueur, Walter

3. Terrorism & liberal state, 1977

66

terrorism prevention

Wilkinson, Paul

4. Inside terrorism, 1998 5. Trans. Terrorism, a chronology, 1980 6. Crusaders, criminals, 1976

47

terrorism religious aspects terrorism incidents terrorism case study

Hoffman, Bruce Mickolus, E.

41 34

7. Time of terror, 1978

33

8. State as terrorist, 1984 9. Political terrorism theory, tactics, 1982

32

10. Intl. terrorism national regional, 1976 11. Political terrorism a new guide, 1988

12. Intl. Terrorism a new mode, 1975

Hacker, F.J. (deceased)

terrorism responses state sponsored terrorism terrorism prevention

Bell, J.B. (deceased) Stohl, M.

30

terrorism anthology

Alexander, Y.

29

terrorism directory

Schmid, Alex P.

27

terrorism

Jenkins, Brian M.

31

Wardlaw, G

Australian Institute of Criminology CSIS; SUNY

Royal Netherlands Academy of Arts & Science Rand Corporation

An investigation of the coauthorship patterns provides an understanding of the researchers’ social network patterns. Figure 1-2 exhibits the coauthorship network of key researchers in scientific collaboration networks. The nodes represent researchers who coauthored papers.

14

Chapter 1. Reid and Chen

In the lower right corner of Figure 1-2, the Rand research teams led by Jenkins and Hoffman is one of the most active clusters. Except for Gunaratna, all of the researchers in the cluster are Rand’s employees. Gunaratna coauthored publications with Chalk and Hoffman, his PhD advisor at St. Andrews University, Scotland, and founded the terrorism research center at the Institute of Defence and Strategic Studies, Singapore.

Rapeport, David C. Bell, J. Bowyer

Crelinsten, Ronald D.

Alexander, Yonah Jenkins, Brian Michael

Chalk, Peter A.

Gunaratna, Rohan Ronfeldt, David F. Arquilla, John Hoffman, Bruce R

Merari, Ariel Cline, Ray S.

Stohl, Michael Steven

Crenshaw, Martha

Pausst, Jordan J.

Mccauley, Clark R. Friedlander, Robert A.

Wilkinson, Paul M

Stern, Jessica Eve

Ramstorp, Magnus Lesser, Ian O.

Figure 1-2. Key Terrorism Researchers’ Coauthorship Network

1. Domain Mapping of Contemporary Terrorism Research

15

Hoffman founded St. Andrews’ Centre for the Study of Terrorism and Political Violence (CSTPV) and created the Rand-St. Andrews terrorism incident database which provides data for their studies [18]. For the cluster in the lower left corner that includes Ranstorp from CSTPV, it is sparse and shares few coauthorships. As chairman of the Advisory Board for CSTPV, Wilkinson has a few collaborations with Alexander but none with researchers at CSTPV who are in this sample. Another cluster includes researchers such as Alexander and Cline at the Center for Strategic and International Studies (CSIS). Since Alexander has 82 coauthors, this cluster displays a pattern of one to many coauthors. We found that coauthorships do not seem to be sustainable because many authors produce only a single publication with Alexander and did not publish with other terrorism researchers in this sample.

4.2

Content Map Analysis

Regarding the next set of questions identified in Table 1-1, several dominating terrorism topics have been identified for 1965-2003. Figure 1-3 displays the contemporary terrorism content map that was generated based on the title and abstracts of the 882 terrorism-related publications in our dataset. The topic map interface contains two components, a folder tree display on the left-hand side and a hierarchical content map on the righthand side [17]. The terrorism publications are organized under topics that are represented as nodes in the folder tree and colored regions in the content map. These topics were labeled by representative noun phrases identified by our programs. The number of terrorism publications that were assigned to the first-level topics is displayed in parenthesis after the topic labels. Major terrorism topics (large regions with depth in the content map) include “low intensity conflicts,” “rand corporation paper series,” “osama bin,’ “political violence,” “rand st andrews chronology,” and “irish republican army”. The topics “rand corporation paper series” and “rand st andrews chronology” highlight the major roles that Brian Jenkins, one of the pioneers of modern terrorism studies [36], and Paul Wilkinson, Chairman of the St. Andrews’ Centre for the Study of Terrorism and Political Violence (CSTPV), Scotland, played. They established terrorism research centers, created databases of terrorism incidents, secured funding for terrorism research projects, produced terrorism studies, and supervised student’s research on terrorism [27]. Several interesting shifts in the cognitive structure of contemporary terrorism research are identified. A traditional terrorism topic, “low intensity conflicts,” first appeared in 1991 and appeared seven other times in the 1990s but only one time in 2000s. Prior to 11th September, the

Chapter 1. Reid and Chen 16

conventional wisdom was that the use of terrorism was endemic in low intensity conflict but that it rarely, if ever, posed a strategic threat to the security of major international powers [36]. After 1997, there was an increasing appearance of the topic “osama bin” which first emerged in our dataset in 1998 as the subject of an article by Peter Bergen [2]. “Osama bin’ referring to Osama Bin Laden is a new topic of interest.

Research Topics biological weapons (4) book reviews (5) changing nature (4) foreign policies (8) international studies (5) irish republican army (6) low intensity conflicts (9) middle east (4) northern ireland (3) osama bin (8) political terrorism (5) political violence (7) rand corporation paper rand st andrews chrono recent trends (5) soviet union (3) terrorist activities (6) osama bin (8)

recent trends (5)

changing nature (4)

biological weapons (4)

terrorist activities (6)

rand st andrews chronology (7)

book reviews (5)

political violence (7)

middle east (4)

low intensity conflicts (9)

irish republican army (6)

political terrorism (5)

northern ireland (3)

rand corporation paper series (8)

international studies (5)

soviet union (3) foreigh policies (8)

Figure 1-3. Contemporary Terrorism Content Map: 1965-2003

1. Domain Mapping of Contemporary Terrorism Research

4.3

17

Co-citation Analysis

For the final set of questions identified in Table 1-1, the author cocitation analysis is used to visualize the closeness of research interests among the key terrorism researchers and their intellectual influences on others. The raw co-citation data derived from keyword searches of the ISI Web of Science were used for the analysis conducted in this part of the study. We created author co-citation networks to identify which key researchers in terrorism are often cited together. Figure 1-4 shows a sample of pairs of authors (researchers) linked by cocitation counts of 1-3. Authorship nodes are represented either by a square or circle followed by the last name of the first author, publication source, and year. The square node identifies a publication that cites the key terrorism researchers (circular nodes). The width of the arrows connecting authorship nodes have been made proportionate to their co-citation counts in size. The narrow arrow width reflects a count of one co-citation link while a thick one reflects a count of at least two co-citation links. To illustrate the findings represented through the author co-citation map, boundaries were drawn around clusters of researchers. Figure 1-4 illustrates four groupings of author co-citation patterns. The groupings provide a way of clustering pairs of researchers who share areas of interests. For example, publications cited in Group A focuses on terrorism and foreign policy (based on terms from the titles and abstracts of their publications). In Group A, Wardlaw’s article on terror as an instrument of foreign-policy is citing several of the most frequent co-cited pairs. The most frequently appearing author co-cited pairs are Laqueur and Wardlaw (13 times), Stohl and Wardlaw (12 times), and Cline and Stohl (12 times). Cline and Stohl specialized in state sponsored terrorism. Group B emphasizes the organizational perspectives of terrorism. It includes Oots’ publication entitled “Organizational Perspectives on the Formation and Disintegration of Terrorist Groups”. Oots cites seven of the key researchers and identifies almost fifty author co-citation pairs. Group C’s subject deals with historical aspects while that of Group D is legal aspects of terrorism. Another way of viewing subgroups and key members in contemporary terrorism research is to analyze their interaction patterns to identify the roles and positions that they play. It was found that, as Figure 1-5 shows, 18 terrorism researchers from the resulting network were co-cited in ISI.

Chapter 1. Reid and Chen 18

[C]

[D] Joyner (Terrorism, 1988)

FRIEDLANDER (TERROR VIOLENCE, 1983) RASSIOUNI (J CRIM LAW CRIM, 1981) Post (Terrorism, 1984)

[A]

Wardlaw (J. Strateg. Stud., 1987)

STOHL (GOVT VIOLENCE REPRES, 1986)

STOHL (CURRENT PERSPECTIVES, 1987)

Merari (terrorism, 1978)

Laquer (Foreign Aff., 1986)

JENKINS (ORBIS, 1984)

Jenkins (Orbis J. World Aff., 1984)

WARDLAW (QUADRANT, 1986)

CLINE (TERRORISM STATE SPON, 1986) Stohl (J. Peace Res., 1983) WILKINSON (WORLD TODAY, 1984)

CLINE (TERRORISM STATE SPON, 1996)

LAQUEUR (FOREIGN AFF, 1986)

STOHL (STATE TERRORIST, 1984)

LAQUEUR (FOREIGN AFFAIRS, 1986)

CRENSHAW (POL SCI, 1987)

[B]

WARDLAW (Political Terrorism, 1982)

RAPOPORT (ASSASSINATION TERROR, 1971)

STOHOL (POLITICAL SCI, 1984)

STOHL (SEM TERR MIDDLE, 1996)

STERLING TERROR NETWORK, 1981

Rapoport (Am. Polit. Sci Rev. 1984)

PAUST (WHITTIER LAW REV, 1983) Post (Terrorism, 1987)

Oots (Terrorism, 1990)

Rapoport (J. Strateg. Stud., 1987) Crenshaw (Orbis J. World Aff., 1985) Crenshaw (Comp. Polit., 1981)

2 times cocitation link

cocitation link

citing link

core author’s article

citing article

CRENSHAW (INSIDE TERRORIST ORG, 1988)

WILKINSON (TERRORISM LIBERAL, 1986)

MICKOLOUS (MANAGING TERRORISM S, 1983)

FRIEDLANDER (MANAGING TERRORISM, 1983)

ALEXANDER (POLITICAL TERRORISM, 1979)

MICKOLOUS (THESIS YALE U, 1981)

Wolf (Terrorism, 1978) LAQUEUR (TERRORISM READER HIS, 1978)

Martin (Terrorism, 1985)

GURR (COMP POLIT STUD, 1988)

GURR (WHY MEN REBEL, 1970)

GURR (J POLIT SCI, 1997)

Post (Terrorism, 1988)

JENKINS JC (J CONFLICT RESOLU, 2001)

Oots (Terrorism, 1989)

JENKINS (INT TERRORISM WORLD, 1975)

Alexander (Terrorism, 1979)

O’Brien (J. Confl. Resolut., 2002)

Figure 1-4. Key Terrorism Researchers’ Co-citation Network

19 1. Domain Mapping of Contemporary Terrorism Research

bassiouni

paust

post

jenkins jc

RESET

alexander

mickolus

Show Network

crenshaw

friedlander

wolf

PRINT

gurr

sterling

wardlaw

rapoport

wilkinson

Level of abstraction (%):

stohl

jenkins

cline

laqueur

0 10 20 30 40 50 60 70 80 90 100

Figure 1-5. The 18 Key Terrorism Researchers Who Were Co-cited in ISI

20

Chapter 1. Reid and Chen

Figure 1-6. Subgroups of Co-cited Authors and Tagged with Leaders’ Names

Figure 1-6 shows the subgroups identified by the system. They have the labels of their leaders’ names (Crenshaw, Post, and Stohl). The thickness of the straight lines indicates the strength of relationships between subgroups. For example, Crenshaw’s group consists of Mickolous (cited with Crenshaw eight times), Post (cited with Crenshaw six times), Wolf (cited with Crenshaw six times), etc. Those familiar with terrorism research would not be surprised with the close co-cited relationship between Crenshaw and Post because they focus on the psychological aspects of terrorism with Crenshaw positing that there is no profile of the typical terrorist.

5.

CONCLUSION

The mapping of contemporary terrorism research provides a perspective that heretofore has not been afforded. As such, the tools such as content map analysis and co-citation analysis can help individuals visualize scholarly development within the field. For instance, while those familiar with terrorism will already know that, say, Stohl and Cline worked in similar areas and are often cited together, those who are not well oriented with the field, particularly new researchers could find such information relevant. Although there are benefits of using visualization techniques, visualization is not a substitute for extensive reading and detailed content analysis for understanding the development of a field. For new researchers, it provides an alternative approach for understanding quickly the structure and development of a field. Thus, the knowledge mapping framework and tools

1. Domain Mapping of Contemporary Terrorism Research

21

provided here, could allow the expanding group of non-traditional terrorism researchers to conduct systematic exploitation of the terrorism field and identify trends and research gaps in a short period of time. This approach helps identify influential researchers in a field, the amount they are cited, the topics that are being investigated, and the frequency of co-citation with other terrorism authors who perhaps work in similar subject areas. With the current challenges in the interdisciplinary and international field of terrorism, new researchers must understand the intellectual structure of the field and how they can better frame their research questions. We intend to supplement this work with other studies that will use timeseries topic maps to present the development trends in terrorism across various periods to further examine the recent evolution and topic changes in the field. We will also include author content map analysis to group individual researchers based on their common research interests. In addition, we will use the results to develop a terrorism expert finder application that supports domain visualization and field test it with new and experienced terrorism researchers.

6.

ACKNOWLEDGEMENTS

This research was funded by the National Science Foundation (NSF), ITR grant (Coplink Center for Intelligence and Security Informatics Research). Authors wish to thank Zhi-Kai Chen, Jennifer Jie Xu, the KnowNet Community, Dr. Jerold Post, and Dr. Marc Sageman for their support and assistance.

REFERENCES 1. 2. 3. 4.

5. 6.

Andrews, J.E., Author Co-citation Analysis of Medical Informatics. Journal of the Medical Library Association, 2003. 91(1): p. 47-56. Bergen, P., Holy War, Inc.: Inside the Secret World of Osama Bin Laden. 2001, New York: Free Press. Borgman, C.L. and J. Furner, Scholarly Communication and Bibliometrics, in Annual Review of Information Science and Technology (ARIST). 2002, ASIST. Boyack, K.W. and K. Borner, Indicator-assisted Evaluation and Funding of Research: Visualizing the Influence of Grants on the Number and Citation Counts of Research Paper. Journal of the American Society of Information Science and Technology (JASIST), 2002. Boyack, K.W., Mapping Knowledge Domains: Characterizing PNAS. Arthur M. Sackler Colloquium of the National Academy of Sciences, 2003, NAS: Irvine. Brandes, U. and T. Willhalm. Visualization of Bibliographic Networks with a Reshaped Landscape Metaphor. In International Conference on Information Visualization. 2002: Konstanzer Schriften in Mathematik und Informatik.

22 7. 8. 9. 10.

11. 12. 13.

14.

15. 16. 17. 18. 19. 20. 21. 22. 23.

24. 25. 26. 27. 28. 29.

30.

Chapter 1. Reid and Chen Chen, C. and R.J. Paul, Visualizing a Knowledge Domain's Intellectual Structure. IEEE Computer Society, 2001. 34(3): p. 65-71. Chen, H., et al., Crime Data Mining: a General Framework and Some Examples. IEEE Computer Society, 2004: p. 50-56. Chua, C., et al., Measuring Researcher-Production in Information Systems. Journal of the Association for Information Systems, 2002. 2: p. 146-215. Cronin, B., High-Fidelity Mapping of Intellectual Space: Early and Recent Insights from Information Science, in Spaces, Spatiality and Technology Workshop. 2002, Napier University, Edinburgh Scotland: Edinburgh. Eggers, S., et al., Mapping Medical Informatics Research. In Medical Informatics: Knowledge Management and Data Mining in Biomedicine, Springer Science, 2006. Ferligoj, A., P. Doreian, and V. Batagelj, Optimizational Approach to Blockmodeling, 1992. Garfield, E. and Welljams-Dorof, Citation Data: their Use as Quantitative Indicators for Science and Technology Evaluation and Policy-making. Science & Public Policy, 1992. 19(5): p. 321-327. Garfield, E., A.I. Pudovkin, and V.S. Istomin, Algorithmic Citation-Linked Historiography: Mapping the Literature of Science, in ASIST 2002 Contributed Paper. 2002. Gordon, A., Terrorism Dissertations and the Evolution of a Specialty: an Analysis of Meta-Information. Terrorism and Political Violence, 1999. 11(2): p. 141-150. Gordon, A., Effect of Database and Website Inconstancy on the Terrorism Field's Delineation. Studies in Conflict & Terrorism, 2004. 27: p. 79-88. Huang, Z., et al., International Nanotechnology Development in 2003: Country, Institution, and Technology Field Analysis Based on USPTO Patent Database. 2003. Hughes, G., Analyze This, The Age. 2003. Incites, Citation Thresholds. 2003, Institute for Scientific Information (ISI): Philadelphia. ISI, How Does ISI identify Highly Cited Researchers? 2003, Institute for Scientific Information (ISI): Philadephia. Kennedy, L.W. and C.M. Lum, Developing a Foundation for Policy Relevant Terrorism Research in Criminology. 2003, Rutgers University: New Brunswick. Krebs, V.E., Uncloaking Terrorist Networks. First Monday, 2002. 7(4). Lin, X., H.D. White, and J. Buzydlowski. AuthorLink: Instant Author Co-citation Mapping for Online Searching. in National Online Proceedings 2001. 2001. New York City: Information Today. McCain, K.W., Mapping Authors in Intellectual Space: a Technical Overview. Journal of the American Society of Information Science, 1990. 41(6). NameBase, Public Information Research, Inc.: San Antonio. http://www.namebase.org Reid, E.O.F. and H. Chen, Contemporary Terrorism Researchers' Patterns of Collaboration and Influence. (unpublished). Reid, E.O.F., Analysis of Terrorism Literature: a Bibliometric and Content Analysis Study. 1983, University of Southern California: Los Angeles. Reid, E.O.F., Evolution of a Body of Knowledge: an Analysis of Terrorism Research. Information Processing & Management, 1997. 33(1): p. 91-106. Reid, E., et al. Terrorism Knowledge Discovery Project: a Knowledge Discovery Approach to Addressing the Threats of Terrorism. In Second Symposium on Intelligence and Security Informatics, ISI 2004, June 2004 Proceedings. 2004. Tucson, Arizona: Springer-Verlag. Reid, E.O.F. Identifying a Company's Non-Customer Online Communities. In Proceedings of the 36th International Conference on Systems Sciences (HICSS). 2004. Hawaii: HICSS.

1. Domain Mapping of Contemporary Terrorism Research

23

31. Schmid, A. and A. Jongman, Political Terrorism: A New Guide to Actors, Authors, Concepts, Data Bases, Theories and Literature. 1988, Oxford: North Holland. 32. Shiffrin, R.M. and K. Borner, Mapping Knowledge Domains, in Arthur M. Sackler Colloquium of the National Academy of Sciences. Held May 9-11, 2003, at the Arnold & Mabel Beckman Center of the National Academies of Sciences & Engineering, Irvine, CA, NAS: Washington, D.C. 33. White, H.D. and K.W. McCain, Visualizing a Discipline: an Author Co-citation Analysis of Information Science 1972-1995. Journal of the American Society of Information Science, 1998. 49(4): p. 327-355. 34. White, H.D., X. Lin, and J. Buzydlowski. Co-cited Author Maps as Real-time Interfaces for Web-based Document Retrieval in the Humanities. In Joint International Conference o the Association for Computers and the Humanities and the Association for Literary and Linguistics Computing (ALLC). 2001. New York City: ACH/ALLC. 35. White, H.D., X. Lin, and J. Buzydlowski, Associative Information Visualizer, in Paper for InfoVis 2004 Contest. 2004. 36. Wilkinson, P. Terrorism: Implications for World Peace. In General Meeting Preparing for Peace Initiative. 2003. United Kingdom: Westermorland. 37. Xu, J., E. Reid, and H. Chen, Finding Communities in Related Networks. (unpublished paper)

APPENDIX: LIST OF 42 INFLUENTIAL TERRORISM RESEARCHERS (AS OF DEC. 2003) Table 1-6. List of 42 influential terrorism researchers (as of December 2003) Author Name # of Active # times Most Date Pubs. Years cited for Frequently pubs in Cited collection Terrorism Publication 1. Alexander, Intl. terrorism 88 32 169 1976 national Yonah regional 2. Arquilla, Cyberwar is 20 30 75 1993 John coming 3. Bassiouni, Intl. terrorism 8 17 22 1975 M.C. & political … 4. Bell, J.B. 47 35 138 Time of terror 1978 5. Bergen, 10 7 16 Holy war inc 2001 Peter 6. Carlton, Terrorism 1 2 21 1979 theory & David practice West Euro7. Chalk, Peter 17 26 20 1996 pean terrorism Terrorism: The 8. Cline, R.S. 8 14 15 1984 Soviet Connection

# times cited

30

18 16 33 15 21

7 14

24 Author Name

Chapter 1. Reid and Chen # of Pubs.

Active Years

Date

17

Most Frequently Cited Terrorism Publication Chapter in Terrorism Interdiscip. Political terrorism a research guide Why violence spreads Black September Calling a truce

9. Cooper, H.H.A

10

25

11

10. Crelinsten, Ronald

19

28

62

11. Crenshaw, Martha 12. Dobson, C.

40

35

90

6

14

25

13. Evans, Ernest H. 14. Flynn, Stephen E 15. Freedman, Lawrence Z. 16. Friedlander, R.A.

3

4

4

4

12

14

21

20

4

10

14

17. Gunaratna, Rohan 18. Gurr, T.R.

14

8

16

51

41

214

19. Hacker, F.J.

3

5

38

121

27

100

13

18

10

38

30

96

6

4

25

37

28

191

5

30

23

4

12

8

20. Hoffman, Bruce 21. Horgan, John 22. Jenkins, Brian M. 23. Kepel, Gilles 24. Laqueur, Walter 25. Lesser, Ian O. 26. McCauley, Clark

# times cited for pubs in collection

# times cited

1977

7

1993

22

1980

23

1974

8

1979

17

Beyond border

2000

8

Terrorism & Intl Order Terror violence Terrorism documents Inside al qaeda

1986

7

1983 1979

7 7

2002

14

1970

145

1976

34

1998

45

1986

5

1975

27

2000

16

1977

75

1975

13

1991

8

Why men rebel Crusaders, criminals Inside terrorism Technology vs terrorism Intl. terrorism new mode Jihad expansion Terrorism Intl. terrorism a chronology Terrorism research & public

1. Domain Mapping of Contemporary Terrorism Research Author Name

# of Pubs.

Active Years

27. Merari, Ariel

25

26

19

28. Merkl, Peter

6

18

6

29. Mickolus, Edward F.

25

28

73

30. Paust, Jordon J.

11

30

13

31. Post, Jerrold

12

19

18

8

13

13

26

33

37

20

30

95

6

7

59

31

34

30

5 21

7 13

10 25

39. Stohl, M.

30

28

136

40. Wardlaw, G.

25

23

49

41. Wilkinson, Paul 42. Wolf, J.B

87

32

229

7

16

11

32. Ranstorp, Magnus 33. Rapoport, David 34. Ronfeldt, David

35. Schmid, Alex P. 36. Sloan, Stephen R 37. Sterling, C. 38. Stern, Jessica E

# times cited for pubs in collection

Bold indicates most influential publications

Most Frequently Cited Terrorism Publication Readiness to kill & die Political violence & terror Trans. terrorism, a chronology Federal jurisdiction over … Terrorist psycho logic Hizb’allah in … Assassination & terrorism Cyberway is coming Networks & netwars Political terrorism a new guide Simulating terrorism Terror network Prospects of domestic bioterrorism State as terrorist Political terrorism theory, tactics Terrorism & liberal state Fear of fear

25 Date

# times cited

1990

8

1986

6

1980

41

1983

11

1990

12

1997

7

1971

20

1993 2001

18 18

1988

29

1981

10

1981 1999

10 12

1984

32

1982

31

1977

66

1981

5

26

Chapter 1. Reid and Chen

SUGGESTED READINGS · Boyack, K.W. Mapping Knowledge Domains: Characterizing PNAS. Arthur M. Sackler Colloquium of the National Academy of Sciences, 2003, NAS: Irvine. · Eggers, S., et al. “Mapping Medical Informatics Research.” In Medical Informatics: Knowledge Management and Data Mining in Biomedicine, ed. by H. Chen, et al. Springer Science, 2006. · McCain, K.W. “Mapping Authors in Intellectual Space: a Technical Overview.” Journal of the American Society of Information Science, 1990. 41(6).

ONLINE RESOURCES · Börner, K., Chen, C., Boyack, K. Visualizing Knowledge Domains. Annual Review of Information Science & Technology, vol. 37. ASIST, 2003. Available at http://www.cs.sandia.gov/projects/VxInsight/pubs/arist03.pdf · Mapping Knowledge Domains. Arthur M. Sackler Colloquium. National Academy of Sciences (NAS), May 9-11, 2003. Available at http://www.bmn.com/

DISCUSSION QUESTIONS 1. What are some advantages of using a knowledge domain framework and tools? 2. What are some of the challenges in using knowledge domain tools? 3. How can you overcome some of the challenges in using knowledge domain tools in emerging fields? 4. Since organizations such as the National Academy of Science (NAS) have started to focus on knowledge mapping, what are some research implications for the terrorism domain? What are some implications for other domains?

2 RESEARCH ON TERRORISM A Review of the Impact of 9/11 and the Global War on Terrorism Andrew Silke School of Law, University of East London, London, U.K.([email protected])

CHAPTER OVERVIEW This survey of terrorism research focused on research studies published in the first five years after the 9/11 attacks. It highlights a number of positive trends which can be seen in this initial period after 9/11. To begin with, it is clear that more researchers are working on the subject than before and there has been a real increase in collaborative studies. This allows studies to be more ambitious in both data-collection and data analysis, though there has only been a very small shift away from literature review-based research. There has, however, been a much more promising increase in the use of descriptive and inferential statistical analysis. The use of inferential statistics on terrorism data in particular has more than trebled since 9/11, a trend which can only help improve the reliability and validity of the conclusions being reached by researchers. Admittedly, this is an increase starting from an extremely low level indeed (and still compares poorly to core journals in other areas) but it is unquestionably a major step in the right direction.

27

28

1.

Chapter 2. Silke

INTRODUCTION

Research on terrorism and terrorism-related issues has increased dramatically in the wake of the 9/11 attacks. This is not surprising. 9/11 witnessed the most destructive terrorist assaults in recorded history, and the attacks led to far bloodier conflicts as part of the subsequent war on terror. Terrorism has become the defining issue of international politics of the first decade of the 21st century. It would be remarkable if such prominence was not matched by a significant increase in research interest in this area. In 1988, Schmid and Jongman noted that 90 percent of the literature on terrorism had been written since 1969. If current trends continue, however, within two or three years we will certainly be able to say that over 90 percent of the entire literature on terrorism will have been written since 9/11. Indeed, we may already have passed that milestone. This is not to say that the literature before was sparse, but rather to emphasize the sheer volume of material now being produced in the area. The scale of this new literature is difficult to grasp. Speaking in September 2002, Yonah Alexander commented that the previous year had seen roughly three new books on terrorism being published each week. This had sounded a considerable number at the time but as Figure 2-1 shows below it actually grossly underestimated the number of new books being published. Indeed, that level of publication was already reached in 2000 when some 150 books on terrorism were published. In contrast, in 2001 this figure jumped massively to 1108 titles, with naturally almost all of these being published in the final three months of the year. 2002 saw an even greater number of titles released with a staggering 1767 titles published (34 new books each week). Each of the following years has seen well over 1000 new books added to the literature. Indeed, the five years since 9/11 have probably seen more books published on terrorism than appeared in the previous 50 years. Currently, one new book on terrorism is being published every six hours. And this is just English-language titles (1). The number of articles on terrorism in the academic journals has also increased hugely (though not to quite the same shocking level as with books). The journal Studies in Conflict & Terrorism brought out four issues per year prior to 9/11. Now it publishes on a monthly basis. Beyond the core terrorism studies journals, articles on the subject in other journals have also increased hugely across the board.(2) The ability to maintain an up-to-date understanding of the literature was already seriously stretched in the 1990s. Now, it is unquestionably impossible for one person to do so, and this can be seen in the growing number of research reviews being published both as articles and as books. In the final decades there were perhaps two or three such books published each decade. Today, that has changed to at least two or

2. Research on Terrorism

29

three published each year (with the volume you hold in your hand being of course another addition), though the sheer amount of new books detailed in Figure 2-1 suggests that even this level may be far too low an estimate.

1800 1600

New titles published

1400 1200

Titles on Terrorism Titles on organised crime

1000 800 600 400 200 0

1995 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005

Figure 2-1. Books published on terrorism 1995 – 2005 (Organized crime books shown for comparison)

The rise in such reviews and surveys of the research literature reflects both the massive increase in volume and more significantly the massive increase in interest. For most of its history the study of terrorism has been conducted in the cracks and crevices which lie between the established academic disciplines. Few researchers devoted most of their scholarly activity to the area – for most it was a brief fling before returning to more traditional interests. But all this seems to be changing. The money available for research has increased markedly and a growing number of younger (and older) researchers are beginning to shift the bulk of their research activity to this area. We appear to be entering a renaissance age for terrorism studies and with so many students and scholars fresh to the field, the need for up-todate and well informed reviews of the research has never been greater. Yet gaining a good understanding of the existing knowledge base on terrorism is intimidating. The potential literature is vast and growing rapidly. In an effort to help provide a framework for understanding the literature, this chapter represents the latest in a series of articles by the author which have reviewed some aspects of research on terrorism.(3)

30

Chapter 2. Silke

The first set of these papers focused on research carried out in the 1990s. That initial review found that many of the traditional problems associated with research on terrorism continued to eat away at the field’s foundations during the 1990s. Early reviews such as Schmid and Jongman’s famous work in 1988 had long appreciated that despite the fact that a very sizable body of literature had accumulated on terrorism, the substance of this writing was often very poor indeed. As Schmid and Jongman noted: “Much of the writing in the crucial areas of terrorism research ... is impressionistic, superficial, and at the same time often also pretentious, venturing far-reaching generalizations on the basis of episodal evidence” (4). This was an observation certainly shared by Ariel Merari who writing a few years later commentated that: “There are few social scientists who specialize in this study area. Most contributions in this field are ephemeral. Precise and extensive factual knowledge is still grossly lacking. Much effort must still be invested in the very first stage of scientific inquiry with regard to terrorism -- the collection of data” (5). In examining the quality of research on terrorism, Schmid and Jongman noted that “there are probably few areas in the social science literature on which so much is written on the basis of so little research”. They estimated that “as much as 80 percent of the literature is not research-based in any rigorous sense; instead, it is too often narrative, condemnatory, and prescriptive” (6). My first review showed that this pessimistic state of affairs was largely unchanged (7). During the 1990s, 68 percent of the research was found to be based on the literature-type reviews criticised by Schmid and Jongman. Further, the related long-running shortage of terrorism researchers also continued to weaken the area. While the backgrounds of researchers may be relatively diverse, there has in general been a consistent lack of researchers to carry out investigative work in the area. Since it emerged as a clear and substantial topic of study, terrorism has suffered from a near-chronic deficiency of active researchers. The 1990s review found that terrorism studies had 40 percent fewer authors contributing to articles compared to fields such as criminology (where many of the same research issues and limitations also apply). The lack of researchers meant that less expensive (in terms of time and effort) data gathering and data-analysis methods were being used with consequent concerns over the quality and reliability of the findings. The next review added analysis of research in the first three years following 9/11 (8). While this showed some distinct changes had taken place in the field, the old problems were still very much present. That said, three years is a very short space of time in research terms. A survey by Garvey,

2. Research on Terrorism

31

Lin and Tomita (1979), for example, found that on average it took researchers 13 months to complete a study and write up the results for submission to a journal (9). Once submitted, it took on average another 15 months before the article actually appeared in print. The result is that it can often take nearly two and half years between research starting and the findings actually making it into print in a journal. Thus the previous review arguably really only assessed the initial wave of research started in the direct aftermath of 9/11, and it is perhaps not terribly surprising that the old, longrunning problems were still very much in evidence. Many of the major funding initiatives only became active after this period, and a review now – five years on – provides a somewhat better opportunity to assess the impact of the post-9/11 environment on the nature of research. Arguably the best way to identify trends and patterns in research efforts is to examine the published literature produced by active researchers. While the literature on terrorism is relatively young in academic terms - existing in a meaningful sense since only the late 1960s – Schmid and Jongman noted that by the time of their review it had nonetheless grown far beyond the scope “of one single researcher [to] survey the field alone”. Indeed, the two Netherlands-based writers pulled in the assistance of over fifty other researchers in order to complete their review. As already indicated, the situation today is considerably more intimidating. The sheer volume of material being published is staggering and even five years after the dramatic events of 9/11 the current flood of books and articles shows no sign of abating. The result is that any effort to review the field faces increasingly difficult decisions in terms of what to review. Hundreds of academic journals have published at least one article relating to some aspect of terrorism in the past ten years. A review which incorporated every such journal would be a formidable undertaking. Fortunately, the presence of two long-established journals which have an explicit and primary focus on terrorism research provides an accessible medium to gauge the state of research. These journals are Terrorism and Political Violence (TPV) and Studies in Conflict & Terrorism (SICAT). Taken together, and bearing in mind their different publishers, separate editorial teams and largely separate editorial boards (though there is some overlap on this last) the two journals can be regarded as providing a reasonably balanced impression of the research activity and interests in the field. However, it is important to note that many active researchers have not published in these two journals and have instead preferred to publish elsewhere. It would be a mistake to assume that all of the key researchers publish in these journals or that the journals reliably represent the nature of most research on the subject. Some other reviews of the field have tried to address this issue by incorporating a wider range of journals. Increasing the

32

Chapter 2. Silke

quantity of journals however is not necessarily a guarantee of increasing the reliability of a review. Czwarno (2006) for example, reviewed 12 journals in her survey (10). These included both SICAT and TPV but also included other journals which only rarely published terrorism related pieces. Czwarno reported that from 1993 – 2001 in most of the journals she reviewed only 1% to 3% of the articles were on terrorism. Such a very low rate does raise question marks over the merits of examining these journals to begin with and raises concerns over how representative the journals were. Czwarno focused primarily on international relations type journals but there would certainly be journals in other disciplines such as psychology and criminology which could also have provided a 1% publication rate. It is churlish however to be too critical. Clearly, there are different benefits to casting a wider net, but the essential point is that it is extremely difficult to be truly representative in reviewing an interdisciplinary area such as terrorism studies. The approach adopted here is to review only those journals which publish primarily and consistently on terrorism (and for both TPV and SICAT the clear majority of their articles are routinely focused on terrorism-related subjects). Consequently, this paper presents the results of a review of the published output of the primary journals in the area from 1990 to October 2006. As with the previous reviews, it is hoped that a review of this nature can be both of interest and of practical value to other writers and researchers on the topic, and that it may also help to establish the broader context in which individual research efforts occur and help illustrate how the field is evolving in the aftermath of 9/11 and the advent of the so-called ‘global war on terror’.

2.

THE NATURE OF THIS REVIEW

Academic journals have a surprisingly diverse range of content. For the two journals under consideration here, this includes articles, research notes, editorials, book reviews, conference reports, review essays, database reports, and official documents and reports. The most immediate question facing a surveyor is how much of this material should be considered? In deciding this, the main criteria has to be which items are consistently the best indicators of significant research activity and effort? This review follows the lead of the UK’s RAE, which has judged that peer-reviewed journal articles provide a good measure of the broad quality of research work. As a result the following review focuses solely on articles published in the journals during the time period. This is a relatively stringent criteria and other reviewers may be willing to be more inclusive. For example, there is case to consider that research

2. Research on Terrorism

33

notes should be included in a review such as this. They have not been included here however because of the considerable variation displayed in the items so classed in the journals. While some research notes were significant documents – both in terms of length and content – most were extremely brief and cursory. Indeed, it is something of a mystery as to why some papers were classed as research notes when they seemed in every respect to be comparable to articles published elsewhere in the same issue. It would be invidious however for one reviewer to subjectively select from among the other categories what he or she regards as equivalent to article standard. Rather than attempt this, this review simply excludes entirely from consideration all items which were labelled or described as other than an article. While this inevitably means that a few significant works are not considered, it means that overall the review is focused on what can be considered to be consistently the substantial research outputs of a nearly seventeen year period (11).

3.

TRENDS IN DATA-GATHERING AND ANALYSIS

One of the most serious problems facing research on terrorism has been the long running shortage of experienced researchers. As a field, terrorism studies has struggled to attract new researchers and then hold onto them. The review of research in the 1990s clearly showed that compared to other academic areas such as criminology (which presents many similar challenges to the study of terrorism), research on terrorism was depending on the work of far fewer researchers. In a review of leading criminology journals it was found that 497 articles had been written by a total of 665 authors. For the terrorism journals in the 1990s, 490 articles were written but this was the output of just 403 authors. This was a far lower level compared to the criminology journals and highlighted the dependence on a small pool of active researchers. The figure also highlighted the lack of collaborative research. As Figure 2-2 shows, less than 10 percent of articles published before 9/11 were the work of two or more researchers. The vast majority of studies were being carried out by individual researchers working alone. This relative isolation emphasised the lack of research funding available in the area. Collaborative research is more dependent on research grants. Without funding, researchers are much more restricted in what they can aspire to and are much more likely to have to squeeze the research effort in between other activity. There are knock-on consequences of such a situation: limited resources mean that research which involves more time and effort will be avoided. Instead, researchers will focus on quicker and cheaper approaches. Quick and cheap is fine to a certain extent, but inevitably if a

34

Chapter 2. Silke

field is very heavily dependent on such work, serious questions about the reliability and validity of any findings must emerge.

Figure 2-2. Collaborative Research

Following 9/11, however, there has been a major increase in collaborative work. This reflects the increased interest among researchers (new and old) for the area and also reflects the increased availability for funding on the subject. As Figure 2-2 shows, collaborative work has more than doubled. The field still lags well behind other applied disciplines such as criminology and forensic psychology, but it is certainly a step in the right direction. The natural following issue is whether the increasing number of researchers and increased funding has led to any improvements in data gathering and analysis. Figure 2-3 presents a somewhat disappointing picture in this regard. An old failing of the field has been the very heavy reliance on literature review methods. Schmid and Jongman were very critical of the paucity of fresh data which researchers were producing. In the 1990s this problem continued with 68 percent of the research essentially taking the form of a literature review and not adding any data which was previously unavailable to the field. The influx of additional researchers since 9/11 does not seem to have improved this situation much. As Figure 2-3 shows, 65 percent of articles are still essentially reviews. While this represents a small improvement on the 1990s, it is only a small one. One feels that a great deal more needs to be done before research is consistently building on past work rather than merely rehashing old data.

2. Research on Terrorism

35

While Figure 2-3 might present a dispiriting picture, there is somewhat more encouragement to be taken from Figure 2-4. While the data gathering methods appear to be more or less the same as before, the way in which this data is analysed does seem to be shifting a little faster.

Figure 2-3. Literature review-based research

Since the 1950s, all of the social science disciplines have experienced a rapid increase in the use of statistics. People are extremely complex, and their behavior and thoughts are the result of a confusing interaction of emotions, motivations, learned behaviors and genetically determined traits. Consequently, social science researchers typically have to work with very ‘noisy’ data where there are potentially a vast number of factors exerting an influence on any one behavior, event or trend. Statistical analysis has emerged as a way for researchers to determine which factors genuinely are important and which are not. Descriptive statistics enable the researcher to summarize and organize data in an effective and meaningful way. Inferential statistics allow the researcher to make decisions or inferences by interpreting data patterns. Inferential statistics are regarded as particularly valuable as they introduce an element of control into research which can help to compensate if relatively weak data collection methods were used. In experimental designs control is normally achieved by randomly assigning research subjects to experimental and control groups. However, this can often be very difficult to achieve in real world research and consequently the lack of control throws doubt on any association between variables which the

36

Chapter 2. Silke

research claims to find. Inferential statistics though can help to introduce a recognized element of control, so that there is less doubt and more confidence over the veracity of any findings (12). It is no coincidence that some of the most significant and influential books published on terrorism since 9/11 have been ones which have made extensive use of statistics to support the authors’ arguments. Such key works include Marc Sageman’s Understanding Terror Networks, Robert Pape’s Dying to Win and Ronald Clarke and Graeme Newman’s Outsmarting the Terrorists (13). While many might disagree with some elements of these books, there can be no denying that each has had a tremendous impact both in the research communities and (even more importantly) among policymakers and other practitioners. It is highly unlikely that these texts could have been as influential if they had not provided and relied heavily on statistical evidence to support the arguments being made. Figure 2-4 shows that these books are unusual within terrorism research. Only a small minority of studies included either descriptive or inferential statistics prior to 9/11. Just 19 percent of articles had such analysis to support any arguments. This is not surprising given the heavy reliance on literature review methods in the field. There has been a definite improvement in the situation since 9/11, with 28 percent of articles now using statistics. This is a definite step in the right direction and the big increase in inferential analysis in particular (going from 3 percent to 10 percent of articles) is an important shift.

Figure 2-4. Statistical Analysis in Terrorism Research

2. Research on Terrorism

37

It is important to stress here that this chapter is not arguing that statistical analysis should be a feature of every research study on terrorism. On the contrary, much valuable research can be conducted which does not involve the use of statistics. However, terrorism research clearly suffers from a serious imbalance and the argument here is that more effort should be made to address this imbalance. Statistics alone are not the way forward, but neither is avoiding their use to the degree that the terrorism research community currently does. The extent of the imbalance is starkly illustrated in Figure 2-5. This compares the use of statistics in journal publications in two other areas of research with the terrorism journals: forensic psychology; and, criminology (14). The reason for choosing these particular areas is that the research backgrounds of both these disciplines have a number of similarities with research conducted on terrorism. The subject matter published in journals in these areas focus on the various actors and activities involved in the criminal justice system and in the commissioning of crime.

90

Descriptive Statistics

5

80 70

Inferential Statistics

81

60

27.5

50 40 30

32.5

20 10

18

10

0 Forensic Psychology

Criminology

Terrorism Studies

Figure 2-5. Comparing statistical analysis across three research areas

38

Chapter 2. Silke

As a result, the subject matter often shares comparable similarities with terrorism in terms of difficult research populations, real world relevance as well as considerable concerns with human suffering and injustice. Thus when compared to other areas within the social sciences, such journals do seem to offer some legitimate comparison with the terrorism journals However, despite the similarities, the manner in which researchers in these two areas treat data is very different to how it is treated by terrorism researchers. 86% of research papers in forensic psychology and 60% of papers in criminology contain at least some form of statistical analysis. In both cases, inferential statistics account for the majority of this analysis. In both disciplines, the use of statistics is seen as an important and accepted way in which to ensure that the claims made by researchers meet recognized quality controls. Despite the improvements since 9/11, terrorism articles still lag well behind these other applied areas, and concerns must remain over the validity and reliability of many of the conclusions being made in the field.

4.

RESEARCH ON TERRORIST GROUPS

One of the most notable findings in the previous reviews of the research literature was just how little research was focused on al-Qaeda in the ten years prior to 9/11. Al-Qaeda was an active and growing organisation in this period and was responsible for several high profile terrorist attacks including the highly destructive bombings of US embassies in Africa in 1998 and the well publicised attack against the USS Cole in 2000. Yet despite what in hindsight seems quite a significant trajectory, the group attracted almost no research attention. As Figure 2-6 shows, in the twelve years prior to 9/11, alQaeda was the subject of only 0.5 percent of research articles. In the core journals this represented only two articles (al-Qaeda was mentioned briefly in other articles but in only two was the organisation a major focus for the research) (15). This failure to notice the growing significance of al-Qaeda has been noticed by other reviewers and most especially by Monica Czwarno who found that the lack of attention paid to the organisation was mirrored across a wide range of journals and was not simply a failing of the two core specialist journals (16).

2. Research on Terrorism

39

Figure 2-6. Research on al-Qaeda

As figure 2-6 emphasises the neglect preceding 9/11 has been replaced by a surfeit of interest in the five years after that date. Currently, out of every seven articles published in the core journals one is focused on al-Qaeda. It is rare indeed for any of the issues published in the last five years to not contain at least one article which is substantially devoted to at least some aspect of the group. Figure 2-7 underlines this transformation in research attention. Since 9/11 there have been 30 research articles in the core journals focused on al-Qaeda (compared to just two in the preceding twelve years). Interest in other groups has remained broadly similar. The most studied terrorist group prior to 9/11, the Irish Republican Army (IRA) still attracts considerable attention. Indeed, the Irish group actually attracts slightly more attention now than it did in the 1990s which is remarkable given the group has been on cease-fire for many years. There have been perhaps more significant increases in attention on groups like Hezbollah and Earth liberation Front which are interesting.

40

Chapter 2. Silke

Figure 2-7. Most studied organisations post-9/11

The increased attention on Hezbollah is especially intriguing as this preceded the 2006 Israeli invasion of Lebanon in an effort to defeat the organisation and cannot be seen as a reaction to such events. On the contrary, it may be a sign that the research literature was showing awareness of the growing significance of the movement. While the research literature clearly missed the growing significance of al-Qaeda, it would be unfair to say that the community was entirely unaware of the growing importance of Islamist terrorism. Figure 2-8 shows very clearly that research on Islamist terrorist groups has been steadily increasing over the past seventeen years. In the first half of the 1990s 14 percent of articles were focused on some aspect of Islamist terrorism. This included groups such as al-Qaeda, Hamas, Islamic Jihad and Hezbollah. This rose to over 23 percent in the latter half of the 1990s representing a significant increase in research attention on this area. Since 9/11, however, Islamist terrorism has completely dominated the field. Nearly 63 percent of the literature is on this subject (almost two out of every three articles). In the past forty years there has never been such a heavy focus on one category of group in the literature.

2. Research on Terrorism

41

Figure 2-8. Research on Islamist Terrorist Groups

While it is understandable that the field would show such a heavy bias in this direction in the aftermath of 9/11 and the war on terror, any objective analysis must still regard the current state of the literature as extremely skewed. If it continues like this for much longer there is a serious risk that terrorism studies as an area will effectively become Islamist terrorist studies with all other types of organisations relegated to only peripheral interest.

5.

RESEARCH ON TERRORIST TACTICS

Suicide terrorism is not a new phenomenon but prior to 9/11 it was certainly relatively ignored by terrorism researchers, considered more of a curiosity than a major subject for analysis. Figure 2-9 shows that only a tiny proportion of articles looked at this issue - only 0.5% of articles - a bare handful. That however changed in the aftermath of 9/11 the most devastating terrorist attacks of all time, and accomplished through the use of suicide tactics. Since 9/11, the amount of research work being focused on this phenomenon has increased enormously. For every one study carried out prior to 9/11, 20 are being carried out now. One article in ten published on terrorism since 9/11 has been focused particularly on suicide terrorism. So intense has been the growth of research on this one aspect of terrorism, that some researchers are now pushing for the creation of a sub-discipline of

42

Chapter 2. Silke

suicide terrorism studies. How realistic (or necessary) such ambitions are is questionable but the debate does at least emphasise the enormous growth of activity on an aspect of terrorism which traditionally was grossly underexplored. The increased work being focused on suicide terrorism is arguably both overdue and useful. However, increased research is also being focused on other aspects of terrorism which are less obviously of growing importance. Of particular concern is the growing amount of research investigating the (potential) use of Chemical, Biological, Radiological and Nuclear weapons (CBRN) – also often referred to as weapons of mass destruction (WMDs) by terrorists. Figure 2-10 shows that the amount of research being focused on CBRN terrorism has doubled since 9/11. The first review on research after 9/11 showed an even higher proportion of articles looking at this issue, though this seems to have declined slightly since then (17).

Figure 2-9. Research on Suicide Terrorism

As with the previous review, a key question here continues to be why is there this increased interest in terrorism using CBRN weapons? After all, 9/11 was not a CBRN attack. 3000 people may have been killed but the hijackers did not use a nuclear bomb to cause the carnage, they did not spray poisonous chemicals into the atmosphere or release deadly viruses. They used box-cutters. Nevertheless, CBRN research has experienced major growth in the aftermath. Is this increase justified?

2. Research on Terrorism

43

Figure 2-10. Research on CBRN Terrorism

The short answer is probably not, but then CBRN research has always probably been over-subscribed. Prior to 9/11, nearly six times more research was being conducted on CBRN terrorist tactics than on suicide tactics. Indeed, no other terrorist tactic (from car-bombings, hijackings, assassinations, etc.) received anywhere near as much research attention in the run up to 9/11 as CBRN. If the relatively low amount of research attention which was given to al-Qaeda is judged to be the most serious failing of terrorism research in the years prior to 9/11, the relatively high amount of research focused on the terrorist use of CBRN must inevitably be seen as the next biggest blunder. To date, in the few cases where terrorists have attempted to develop CBRN weapons they have almost always failed. In the handful of instances where they have actually managed to develop and use such weapons, the highest number of individuals they have ever been able to kill is 12 people. In the list of the 300 most destructive terrorist attacks of the past twenty years, not a single one involved the use of CBRN weapons. Yet somehow one impact of the 9/11 attacks is that CBRN research - already the most studied terrorist tactic during the 1990s - has actually managed to attract even more research attention and funding - doubling the proportion of articles focused on CBRN in the journals. If the articles were focused on mass casualty terrorism that would be more understandable. 9/11 was certainly a mass casualty terrorist attack, and

44

Chapter 2. Silke

indeed there have been a few studies which have looked at mass casualty terrorism since 2001 (18). However, the research is not taking such an approach and instead is very much focused on terrorist use of chemical, biological, radiological or nuclear weapons (CBRN). This relative (but increasing) obsession with CBRN is disturbing for a number of reasons. First, it detracts attention from more lethal tactics which terrorists frequently and routinely use. Consider the lack of attention given to suicide tactics in the 1990s. Well over 1000 people were killed by suicide terrorism in the 1990s. In the same period, attacks using CBRN weapons killed just 19 people. Yet it was CBRN which attracted six times more research energy than suicide terrorism. A degree of research looking at CBRN terrorism is justified. Instances such as the 1995 Tokyo subway attack and the post-9/11 anthrax letters show that CBRN attacks can happen (albeit only rarely). Such attacks have never caused mass fatalities however and the popular acronym of Weapons of Mass Destruction (WMD) in describing CBRN weapons is desperately misleading. Despite the rarity - and the extreme unlikelihood of terrorists being able to accomplish a truly devastating attack using these weapons – CBRN remains a popular topic for government and funding bodies. They will award research grants for work on this topic when other far more common and consistently far more deadly terrorist tactics are ignored. Those who had hoped that 9/11 - a stunning example of how non-CBRN weapons can be used to kill thousands of people - might then have heralded at least a modest shift away from CBRN research will be disappointed. Ultimately, the central lesson of 9/11 in this regard has been profoundly missed.

6.

SOME CONCEPTUAL ISSUES

Terrorism has a very long history, one that can be comfortably traced back thousands of years (19). Yet, it would be difficult to appreciate this based on the literature published in the core journals in the past two decades. As Figure 2-11 shows very little research explores past terrorist conflicts. Before 9/11, only one article in 26 looked at historical conflicts. Since 9/11, interest in historical cases has collapsed and now only one article in 46 is focused away from current events. It is natural and reasonable that in the years immediately after the most destructive terrorist attacks in recorded history, that the research field should focusing on the now, on current issues, actors and events. Such a strong focus on contemporary issues, however, runs the real risk of losing an

2. Research on Terrorism

45

understanding of the broader context of terrorist conflicts, patterns and trends and without such awareness important lessons can be missed.

Figure 2-11. Research with a historical focus

An example I have used previously is that many observers treat the current US military involvement in Iraq as a strictly modern issue linked only to the previous Iraq war and the more recent Global War on Terror. There is no awareness that this is not the first time that the US military has faced an insurgency in an occupied country where the insurgents frequently use suicide tactics to attack technologically superior American forces. Yet, this was exactly the circumstances faced by US forces at the start of the 20th century as they fought insurgents in the Philippines. Beginning in 1900, US control of the Southern islands of the Philippines was contested by native Moro tribes. The US forces typically won overwhelming victories in all their conventional battles with the Moros, but then faced increasing attacks from individual amoks and juramentados, Moro warriors who attacked US positions and personnel in suicidal efforts armed often only with swords and spears (20). It took nearly 13 years of fighting before Moro resistance to the US presence finally receded. Yet the lessons from this bitter and painful conflict are being ignored. A closer inspection of such historical cases may help prevent the current conflict in Iraq enduring 13 years. Ignoring such experiences however seems unlikely to improve the odds of a more successful campaign.

46

Chapter 2. Silke

Yet terrorism research has never been especially good at exploring the past. Prior to 9/11, only 3.9% of articles examined non-contemporary terrorism and less than half of these looked at terrorism prior to 1960. We know that terrorism is not a recent phenomenon and that it has been occurring in some form or another for over two thousand years. Yet this wider context is almost entirely ignored as terrorism research is increasingly driven by a need to provide a short-term, immediate assessment of current groups and threats. Efforts to establish more contextualised and stable guiding principles have been almost entirely side-lined. This is a serious cause for concern and the dramatic decline in historical research since 9/11 is deeply troubling.

7.

CONCLUSIONS

Prior to 9/11, the study of terrorism was carried out on the periphery of academia. The funding available for researchers was extremely limited and the number of researchers prepared to focus a substantial element of their careers on the subject was paltry. In most cases it was harmful to an academic or research career to follow such interests and most of those who were genuinely interested in the subject found that they had to incorporate other issues into their work in order to remain professionally viable. 9/11 has brought much greater interest in the subject of terrorism and for the first time the possibility of an expanded core of dedicated researchers exists. It is likely that the field and the amount of research being conducted will continue to grow over the coming years. It is not certain however whether this growth will be sustained or even if the gains made in the first years since the New York and Washington attacks will not be eroded over the coming decade. In considering the focus of research on terrorism since 9/11, there are some worrying trends. The increased attention to CBRN threats is unjustified and it is disturbing that even more research activity is now being devoted to this area. The relatively heavy focus on CBRN prior to 9/11 was misplaced to begin with and produced research which was worthless with regard to what al-Qaeda did then and subsequently. The concern with CBRN is ultimately built on the premise of the fears and nightmares of politicians and policy-makers. The link to reality is often tenacious at best. The diminishing place for historical analysis in terrorism research is also a cause for concern, but it is probably wise not to place excessive emphasis on this trend at this stage. The 9/11 attacks were the most destructive terrorist attacks in recorded history and many of the key factors relating to the event were notoriously under-studied (e.g. al-Qaeda, suicide terrorism,

2. Research on Terrorism

47

etc.). It is only natural that the field should now devote serious and substantial effort to improving our knowledge base and understanding of these subjects. Terrorism research, however, does have a legacy of missing important trends. The research of the 1990s would not have flagged to an interested reader that al-Qaeda would be universally regarded as the most important and prominent terrorist group of the 2000s. One wonders what other significant trends are now being dangerously overlooked? Yet, this survey of research has not reached entirely negative conclusions and it is important to highlight a number of positive trends which can be seen in this initial period after 9/11. To begin with, it is clear that more researchers are working on the subject than before and there has been a real increase in collaborative studies. This allows studies to be more ambitious in both data-collection and data analysis and while there has only been a very small shift away from literature review-based research, there has been a much more promising increase in the use of descriptive and inferential statistical analysis. The use of inferential statistics on terrorism data in particular has more than trebled since 9/11, a trend which can only help improve the reliability and validity of the conclusions being reached by researchers. Admittedly, this is an increase starting from an extremely low level indeed (and still compares poorly to core journals in other areas) but it is unquestionably a major step in the right direction. Ultimately, it is still very early to judge what the overall impact 9/11 and the new world order will have on terrorism research. This review was based on the research studies published in the first five years after the attacks. As discussed earlier, within research timeframes this is a short period of time. It will probably be another two or three years before a full and reliable assessment of the impact of the 9/11 on terrorism research will be possible. To date, we have seen that the field has become even more concerned with contemporary issues than before. This is probably unhealthy if it lasts but is hardly surprising given the issues which were missed prior to 9/11. It is worth recognising as well that the field is showing signs of generally moving in the right direction when comparisons are made with the results of the first review carried out three years after 9/11. Compared to this chapter, that earlier review found a higher level of CBRN research, less historical research, less collaborative work, less variety in research methods, and less use of statistical analysis. In short on almost all of the key issues considered here, the first three years were less satisfactory than a review which includes the full five years after 9/11. The differences between these two reviews in most cases are small, but they exist nonetheless. The hope is that they represent a swing in positive directions, a change of direction which can be maintained and built upon.

48

Chapter 2. Silke

REFERENCES 1.

2. 3.

4.

5. 6. 7. 8. 9.

10. 11.

These figures are based on statistics provided by Amazon.com. The statistics relate to non-fiction titles on the subject of terrorism published in a given year. The figures may not include every relevant title published in a year, but should be seen as broadly representative. The statistics were accessed on August 1, 2006. See, for example, Monica Czwarno (2006). Misjudging Islamic Terrorism: The academic community’s failure to predict 9/11. Studies in Conflict and Terrorism, 29/7, pp.657-694. The findings from the previous reviews were published in the following papers: (1) Andrew Silke (2001). The Devil You Know: Continuing Problems with Research on Terrorism, Terrorism and Political Violence, 13/4, pp.1-14; (2) Andrew Silke, (2004). The Road Less Traveled: Recent Trends in Terrorism Research. In A. Silke (Ed.), Research on Terrorism: Trends, Achievements and Failures (pp.186-213). London: Frank Cass; and, (3) Andrew Silke (2006). The Impact of 9/11 on Research on Terrorism. In Magnus Ranstorp (Ed.) Mapping Terrorism Research. Oxford: Routledge. Alex Schmid and Albert Jongman (1988). Political Terrorism: A New Guide to Actors, Authors, Concepts, Databases, Theories an Literature (Amsterdam: North Holland Publishing Company), p.177. Ibid. Ibid., p.179. See Andrew Silke (2001) note 3, and Silke (2004) note 3. Andrew Silke (2006) note 3. Garvey, W., Lin, N., & Tomita, K. (1979). Research studies in patterns of scientific communications: III, Information-exchange processes associated with the production of journal articles. In W. Garvey (Ed.), Communication: The essence of science (pp.202224). Oxford, England: Pergamon Press. Monica Czwarno (2006). Misjudging Islamic Terrorism: The academic community’s failure to predict 9/11. Studies in Conflict and Terrorism, 29/7, pp.657-694. Each article which was published in the review period was entered into a database based on eleven separate features. Coding was made for each author of each article on the following features: a. Author name b. Whether first, second or third author c. Journal title d. Journal Volume details e. Year of Publication f. Country where the author is based g. Occupation/background of the author h. Geographic focus of the article i. Temporal focus of the article j. Terrorist Group focus of the article k. Terrorist Tactic focus of the article l. Conceptual focus of the article m.Data-gathering methods used n. Statistical analysis methods used

2. Research on Terrorism

49

12. Chava Frankfort-Nachmias and David Nachmias, Research Methods in the Social Sciences (5th edition) (London: Arnold, 1996) pp.427-428. 13. Marc Sageman (2004). Understanding Terror Networks. Philadelphia: University of Pennsylvania Press; Robert Pape (2005). Dying to Win: The Strategic Logic of Suicide Terrorism. New York: Random House; Ronald Clarke and Graeme Newman (2006). Outsmarting the Terrorists. London: Praeger Security International. 14. Two journals from both disciplines were reviewed. In all the cases the review period stretched from 1995 to 1999 and a random selection of eight issues from each journal title were reviewed. 15. The criteria used when judging the focus of an article was that the paper had to be primarily about one or at most two groups. It was not sufficient that a group was briefly mentioned or received discussion of a page or two. There had to be substantial evidence that the group was a major focus of the article. 16. Monica Czwarno (note 2). 17. See Andrew Silke (note 7). 18. For example the valuable contributions made by Chris Quillen: Chris Quillen, ‘A historical analysis of mass casualty bombers’, Studies in Conflict and Terrorism 25/5 (2002) pp.279-292; and, Chris Quillen, ‘Mass casualty bombings chronology’, Studies in Conflict and Terrorism 25/5 (2002) pp.293-302. 19. For an excellent introduction to this subject see Robert Asprey, War in the Shadows (London: Little Brown, 1994). 20. For more on this campaign see D. Woolman, ‘Fighting Islam’s fierce Moro warriors’, Military History, 9/1 (2002) pp.34-40.

SUGGESTED READINGS · Ranstorp, M. (2006). Mapping Terrorism Research. London: Routledge. · Schmid, A. and Jongman, A. (1988). Political Terrorism: A New Guide to Actors, Authors, Concepts, Databases, Theories and Literature (Amsterdam: North Holland Publishing Company), · Silke, A. (2004). Research on Terrorism: Trends, Achievements and Failures. London: Routledge.

DISCUSSION QUESTIONS 1. Very little research was carried out on al-Qaeda prior to 9/11. Can you assess why this happened? (It might be helpful to consider the terrorist groups which were receiving most of the research attention.) 2. Research on terrorism can be biased in a number of ways. Try and identify some potential biases and assess how they may affect the way research is conducted. 3. Does the wider interest in CBRN weapons help or harm terrorism studies?

50

Chapter 2. Silke

4. Based on the material in this chapter, what do you think are the most serious problems facing research on terrorism today?

3 WHO ARE THE KEY FIGURES IN ‘TERRORISM STUDIES’? Sam Raphael King’s College, London (KCL), U.K. ([email protected])

CHAPTER OVERVIEW The first part of this chapter constructs a analytical framework to enable the key figures in the field of terrorism studies to be identified. Use of this framework by future studies will ensure that their analysis of terrorism studies is based on a sample of authors and works which have been selected with sufficient methodological rigour. To have impact, such studies – which may interrogate the quality of research on terrorism, or examine the relationship between terrorism ‘knowledge’ and power, or attempt to reveal the existence of an ‘invisible college’ – must be able to show that they apply to the core (or, at least, a core) of terrorism studies, and that the selection of this core was achieved in a rigorous and explicit manner. The second part of this chapter employs this framework in order to identify three ‘pools’ of researchers: a periphery pool of over 300 authors, a central pool of 140 authors, and a core pool of just 31 authors.

51

Chapter 3. Raphael

52

1.

INTRODUCTION

This chapter describes one possible answer to a question which will be of interest to those examining ‘the state of the field’ of terrorism studies: who are the key figures in the field of terrorism studies? The results obtained from this research question can be used for a variety of further projects: once identified, the key figures themselves could be subjected to greater analysis (examining, for instance, their institutional affiliation, or their relationship to government); alternatively, their published works could be the subject of further inquiry (1). These second-order questions are not considered here. Rather, the chapter’s primary concerns are twofold: to construct a framework within which people can think about how to identify the key figures in a way which displays sufficient methodological rigour; and to make an initial attempt at employing this framework, in order to generate a sample pool of key figures. As will become clear, the results obtained depend very much on several choices made regarding research design; choices which must be made, and made explicitly, if the results are to stand up to scrutiny on methodological grounds. First, when is the time period considered by the study? Second, how is ‘terrorism studies’ to be defined, and delineated from other fields of academic study? Third, given that expertise is not an objective quality held independent of social context, whose opinion is to be privileged when deciding who within the field is considered key? Fourth, how is this opinion to be measured, from the wide range of possible scales that exist? Finally, what threshold will be applied in obtaining a specific pool of researchers? In other words, how stringent should the selection criteria be, where higher thresholds will produce a smaller results set? This chapter examines the significance of these research design choices, which ultimately ensure that each separate attempt to ascertain the key figures of terrorism studies is likely to identify a different pool of researchers. By making its own choices in this regard, the chapter will also identify its own pool of key figures in terrorism studies. With one eye on the research design choices made by this study – the methodology employed – its results can be compared with others that have addressed the same research question (2). In particular, this study identifies three pools of researchers, each of a different size and with various degrees of centrality to the particular community which is taken to represent ‘terrorism studies’. Thus, it finds that there is a periphery pool (with 312 members); a central pool (a subset of the periphery pool, with 140 members); and a core pool (a subset of the central pool, with 31 members). This final, core pool can be taken to include those researchers who are the key figures of terrorism studies. And although other studies, by virtue of their different research designs, will identify a non-

3. Who are the Key Figures in ‘Terrorism Studies’?

53

identical set of researchers as key, the results obtained here display a high degree of intuitive plausibility. That is, despite the inclusion of some unexpected authors, and the surprise omission of others (a feature to be expected as a result of all studies which do not simply set down a subjective list of who is considered key by the author), the results obtained here broadly correlate to those which would be ‘expected’ by many who are familiar with the field (3).

2.

CONSTRUCTING THE FRAMEWORK The Multiplicity of ‘Terrorism Studies’, the Role of the Audience, and the Importance of Methodological Rigour

When establishing the parameters of terrorism studies, as well as when identifying the key figures within the field, the question of methodology is fundamental. Absent an explicit and rigorous process through which either is determined, a study is open to the charge of selecting, by stealth, both the field and the key figures within it in order to verify pre-existing assumptions. These assumptions may be to do with the nature of the field of terrorism studies, the identities of the pre-eminent experts working within this field, or the characteristics of the work produced by these key figures (4). For a study to be rigorous in this sense, it needs to resolve five issues: when the relevant time period for study is; which actual research community is being examined; who the relevant ‘expert-determining’ audience is; how the opinion of that audience is to be measured; and what the threshold of that measurement is, above or beyond which would signify a key position within the research community (and in particular, whether that threshold is an absolute or relative quality). As with other academic fields, determining the boundaries of ‘terrorism studies’ is problematic. This ambiguity is a function of both the lack of consensus regarding the definition of core concepts (i.e., what exactly is the ‘terrorism’ which ‘terrorism studies’ is studying?), and of the sheer number of those writing about terrorism. Given the myriad of perspectives employed by the literally thousands of academics who have published on the subject, and the varying degrees of commitment to sustained research on terrorism, an all-inclusive pool of terrorism researchers would consist of authors with little in common (5). Indeed, some argue that talk of a ‘terrorism studies’, as if it exists as a coherent field at all, is misleading, whilst proactive attempts to forge a independent identity for the ‘science of terror’, by pulling it out from ‘the cracks and crevices which lie between the large academic

54

Chapter 3. Raphael

disciplines’, are misguided (6). Regardless of the desirability or otherwise of forming a distinct field, it is clear that a singular, easily-identifiable ‘terrorism studies’ does not exist; it is therefore impossible to speak of ‘key figures within terrorism studies’ without further qualification. However, it may be possible to conceive of several ‘research communities’ which contribute, to a greater or lesser extent, to the study of terrorism. These communities can be seen as the analytical units which, in a loose sense, combine to form the field. Rather than mutually-exclusive subfields which allow for the neat division of the study of terrorism, they should be considered a multitude of independent, yet overlapping, aspects of a field which itself is amorphous and ill-defined, but which at the level of individual community can be made concrete, defined exactly, and subjected to rigorous analysis. For example, one might make the case for researchers clustered around a particular institution (e.g., RAND) to be considered a viable research community. Alternatively, those who publish in a certain set of outlets (e.g., a collection of particular journals) about a specific subject (e.g., nonstate terrorism, or religious terrorism), could be considered a viable research community. The term ‘viable’ is of interest here, as the degree to which the centrality of that community to the idea of a ‘terrorism studies’ can be defended will determine the degree to which the results obtained are considered relevant to the study of ‘terrorism studies’. In other words, if one does not accept a proposed community (say, everyone who contributes to a particular website) as reflecting a central aspect of one’s broad conception of the field, then one will not consider the results of the proposed study as particularly significant. In this way, despite the problems associated with the identification of key figures with terrorism studies per se, it becomes possible to speak of key figures within a certain research community. Shifting the focus in this way affects the universal applicability of the results obtained. Indeed, acknowledging that any research into ‘terrorism studies’ is actually research into one particular community amongst many reveals the possibility that two studies, each claiming to analyse the characteristics of ‘terrorism studies’, will arrive at very different conclusions by virtue of the fact that they are analysing distinct communities. Not only is the idea of a coherent field of ‘terrorism studies’ a problematic one; the notion of ‘expertise’ also requires further exploration. Expertise is an intersubjective quality (7). Rigour can therefore only be obtained by treating expertise in relation to a particular audience; a social or political grouping that, in a collective sense, invests the quality of expertise in a certain set of actors. Therefore, once the research community is identified each study has a second choice to make: which audience will be

3. Who are the Key Figures in ‘Terrorism Studies’?

55

put centre-stage; the opinions of which group of people will be privileged, with regards to who in any particular research community is key? Examples of choices which can be made regarding research community and audience, as well as time-scale, measurement scale and threshold, are provided in Table 3-1: Table 3-1. When the relevant Study time period is

A

1968-2003

B

1979present

C

1991-9/11

D

9/11present

Which research community is being examined That based around panels on terrorism in the five most relevant conferences That based around posts as ‘terrorism experts’ in the ten biggest thinktanks That based around the publication of terrorism articles in the top-20 IR journals That based around posts as ‘terrorism experts’ in the top-100 universities, who are exgovernment employees

Who the relevant audience is

How the audience’s opinion is to be measured

What the threshold of that measurement is

US Media

No. of interviews in top-ten US newspapers

All those interviewed more than ten times

US Military

Award of DOD contracts

All those awarded more than £50k

European General Public

High-street book sales across Europe

The top 20 biggest sellers

Questionnaires

All those receiving more than three mentions

British Counterterr or officials

Within each of these hypothetical studies, there is no pre-determined link between any of the five design choices: Study A could legitimately decide to measure the key figures in its research community (based around the conference circuit) by reference to the general public, and could choose to focus on the post-9/11 years. Likewise, one could decide to measure general public opinion using opinion polls instead of book sales, or could choose to establish an absolute, rather than relative, threshold of the book-sales measurement (e.g., all those selling more than 20,000 copies, rather than the top 20 biggest sellers, will be considered ‘key figures’).

56

Chapter 3. Raphael

Of obvious significance here, every study which is ostensibly examining the same subject (‘terrorism studies’) could potentially arrive at a different understanding of who is key, given the very different choices made regarding research community, audience, measurement, and threshold. Even studies of the same research community will potentially produce a very different set of results. Moreover, each of these five choices has an inescapable political function. By either foregrounding certain audiences or research communities over others, or by ensuring that the choices are made so as to generate results which conform to pre-existing assumptions and overarching political agendas, they privilege certain social and political perspectives over others. However, by ensuring that a study makes its methodology explicit, its results can then be gathered in an impartial, objective sense, can be fully justified by reference to the choices, and can be re-generated at will by others.

3.

EMPLOYING THE FRAMEWORK Selecting the Time Period; Constructing the Research Community

As a specific phenomenon, contemporary terrorism is generally considered to have emerged during the late 1960s (8). The birth of the academic consideration of this phenomenon can also be charted back to this time (9). However, in employing the framework described above, this study excludes the first decade of considerable research, restricting the analysis to a shorter timeframe: the twenty-five years between September 1979 and September 2004. This choice ensures that the results more accurately reflect the period during which a core community within terrorism studies has operated in a unified and coherent manner. It therefore excludes the initial period of flux, beginning instead when research on terrorism had ‘stabilised’ after its initial take-off period (10). This stabilisation at the end of the 1970s, and the consequent emergence of a concrete research community (as opposed to a collection of disparate researchers), can be seen in the establishment of the two core journals of the time: Terrorism (first published in 1977) and Conflict (first published in 1978). As will be seen, the management of, and the output from, core academic journals will be taken as a significant criteria when establishing the key figures of the research community. This study will focus on two research communities, both of which are central to any viable conception of a ‘terrorism studies’. The first community consists of the approximately 200 people identified by Schmid and Jongman in their major survey of the field as representing ‘a good cross section of the

3. Who are the Key Figures in ‘Terrorism Studies’?

57

field’, plus the extra individuals identified by this group via Schmid and Jongman’s questionnaire. Together, the community consists of around 400 individuals (11). Although one may question the basis upon which Schmid and Jongman selected the original 200 authors (were they really a good cross-section of the field? According to which measure?), the success of their effort can be measured by the subsequent approval bestowed upon it by the wider research community (12), as well as by the extent to which their results have been used by others who attempt to research characteristics of the field of terrorism studies (13). However, despite the wide acceptance of Schmid and Jongman’s methodology, and the continued use of their results by others, the data are now more than twenty years old (the questionnaires were sent out in 1985). For current analyses to remain relevant, it must be supplemented by the consideration of an additional research community. This is particularly true if the study is interested in the key figures in terrorism studies over the entire 1979-2004 period; Schmid and Jongman’s research provides a fascinating snapshot of a research community as it existed during the mid-1980s, but is not necessarily applicable outside of this context. Given that the sheer size of today’s field makes it ‘unlikely that anyone would happily attempt to replicate Schmid and Jongman’s review’ (14), and that identifying a new ‘good cross-section of the field’ begs the question of what constitutes the field, this study will identify a second, separate research community which will fulfil this supplementary function: that which is clustered around the core journals of the field. The ‘core’ is taken to be those journals which have a large proportion of their content dedicated to terrorism. In line with the findings of others, this study identifies two current core journals (Terrorism and Political Violence (TPV), and Studies in Conflict and Terrorism (SCT)), and four in total over the 1979-2004 time period (Conflict and Terrorism amalgamated in 1992 to form SCT). Gordon has found that 27% of all journal publications on the subject of terrorism between 1988 and 1998 were concentrated in TPV, SCT and their predecessors. This concentration ‘constitutes the nucleus of publications in the field, and the journals in the nucleus are core journals’ (15). Likewise, Silke finds that the two current core journals ‘exist as the primary publishing outlets for research on terrorism’, and that, taken together, they ‘can be regarded as providing a reasonably balanced impression of the research activity and interests in the field’ (16). These findings are confirmed by a survey of a sample of academic journals, designed to establish the number of terrorism articles published between 1979 and 2004 (17). Table 3-2 lists the results obtained from a search of one of the largest social science bibliographic databases (18):

Chapter 3. Raphael

58 Table 3-2. Journal Terrorism and Political Violence Terrorism Studies in Conflict and Terrorism Conflict Contemporary Security Policy Survival Washington Quarterly International Security International Affairs Foreign Affairs Israel Affairs Journal of Strategic Studies International Peacekeeping Security Studies Total number in IBSS (1979-2004)

Number of ‘Terror’ Articles (19792004)

Total Number of Articles (19792004)

% Total Focused on ‘Terror’

485

808

60

37

52

60

213

553

39

5

65

8

39

567

7

83

1333

6

59

1140

5

23

632

4

82 64 6

3449 2915 494

2 2 1

6

814

0.7) concerns that category Country

Afghanistan Algeria Angola Azerbaijan Bahrain Bangladesh Benin Botswana Burkina Faso Burundi Cameroon Central African Rep. Chad China Colombia Comoros Costa Rica Cuba

Econ. Depend.

External Threat

Regional Instability

0.00 0.00 1.86 0.00 0.00 0.00 8.46 6.67 14.38 0.00 0.00 0.00

0.13 5.58 0.47 0.00 0.00 0.00 0.00 0.00 0.00 6.88 0.00 0.00

0.04 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00

2.42 1.30 1.14 0.00 0.00 0.00

6.36 0.00 0.45 0.00 0.00 0.00

0.00 0.00 0.00 0.00 0.00 0.00

Rejection of State Authority 0.00 1.15 0.00 0.00 0.00 0.00 0.00 0.00 0.63 14.38 0.00 0.00 0.00 0.09 1.14 0.00 0.00 0.00

Tension between Groups 0.17 0.00 0.00 0.00 0.71 1.15 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00

Weak Judicial System 0.00 0.00 0.00 0.00 0.24 0.00 0.00 0.74 0.00 0.00 0.00 0.00 0.00 0.03 0.00 0.00 0.00 1.64

Chapter 6. Bobeica, et al.

136 Country

Dem. Rep. Congo Eritrea Ghana Greenland Guam Guinea India Iran Iraq Israel Ivory Coast Kenya Kuwait Lebanon Malaysia Namibia Nepal Nigeria Pakistan Palestine Republic Congo Rwanda Russia Saudi Arabia South Africa Sudan Syria Tanzania Uganda USA Yemen Zambia Zimbabwe

Econ. Depend.

External Threat

Regional Instability

Rejection of State Authority 0.81

Tension between Groups 0.00

Weak Judicial System 0.00

1.35

2.16

0.00

0.00 2.41 0.00 0.00 0.00 1.18 0.26 0.00 0.00 0.00 2.36 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00

0.00 0.00 0.00 0.00 0.00 0.00 0.11 0.26 0.06 0.00 0.83 0.00 0.00 0.00 0.00 2.50 0.00 0.00 0.00 2.00

0.00 0.00 0.00 0.00 0.00 0.00 0.11 0.03 0.00 0.00 0.00 0.29 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00

0.00 0.00 0.00 0.00 0.48 1.12 0.05 0.01 0.00 0.63 0.00 0.00 0.00 0.18 0.00 23.75 0.09 0.75 0.00 1.17

0.00 0.00 0.00 0.00 0.00 0.53 0.74 0.18 0.38 0.00 0.00 0.00 0.00 0.71 0.00 0.00 0.73 0.81 0.94 0.00

0.00 0.00 0.00 0.00 0.00 0.24 0.00 0.08 0.00 0.00 0.00 0.00 0.00 0.00 0.95 0.00 1.18 0.19 0.00 0.00

0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00

1.82 0.00 0.71 0.00 3.00 0.00 1.30 1.18 0.19 0.00 0.00 0.00

0.00 0.00 0.13 0.00 0.00 0.46 0.00 0.00 0.04 0.00 0.00 0.00

1.27 0.02 0.00 0.00 0.17 0.00 2.61 3.24 0.03 0.00 0.00 0.00

0.00 0.00 0.65 0.27 0.00 0.00 0.00 0.00 0.09 0.00 0.00 0.00

1.27 0.00 0.00 0.27 0.00 0.00 2.17 0.00 0.08 0.24 2.22 0.47

APPENDIX 2: CONFLICT INDICATORS 1. 2. 3. 4. 5. 6.

Civil and Political Economic Dependence Environment Degradation External Threat Macroeconomic Stability Press Freedom

6. Public Arbitration 7. Regional Instability 8. Rejection of State Authority 9. Religious and Cultural Rights 10.Tension between Groups 11. Weak Judicial System

6. A Quantitative Analysis of the "Root Causes of Conflict"

137

APPENDIX 3: FIGURES

Figure 6-9. Relative importance of indicators: Chad, Democratic Republic of Congo, Rwanda, Zimbabwe

Figure 6-10. Relative importance of indicators: Burkina Faso, Central African Republic, Kenya, Nigeria, Sudan

138

Chapter 6. Bobeica, et al.

Figure 6-11. Relative importance of indicators: Iran, Iraq, Israel, Palestine

Figure 6-12. Relative importance of indicators: other Islamic countries

6. A Quantitative Analysis of the "Root Causes of Conflict"

139

APPENDIX 4: WORD LISTS An example of the word lists used to define each root cause of conflict indicator. This is a partial word list for “External Threats.” It was developed using LSA itself as described in the text. abuse abused abuses abusive aggressor aggressors ammunition arm armed arming arms army artillery assassinate assassinated assassination assassinations atrocities atrocity attack attacked attacks baffle baffles barrages beheaded billet billeted blacklisted bombing bomb bombs casualties casualty cell cells civil civilian civilians coalition combatant combatants command commanders

compromise conspiracy conspirators conspiration conspire contrary counter countered coup coups damage damaged defeat defeated defence defensive destabilize destabilized destabilizes diplomatic disloyal disloyalty dissent dissenter dissidents enclave enclaves ethnic execute executed execution external extortion extremism extremist extremists faction factions fiefdoms finance financed financial flee follower

force forces foreign front fuel fuelled government governments grenades guerrillas gun guns hostile hostilities illegal illegitimacy illegitimate illicit imposed impunity income independence inquisitive insurgency insurgents massacre massacres mercenaries militants militarized military militia militias mines munition munitions neighbor neighbors opponent opponents oppose opposed opposing opposition

oust ouster perpetrate perpetrated political politicizes predate predated propaganda punitive rebel rebellion rebels regime regimes reject rejection revolution revolutionary right rights rival rivals rulers salvation separatism separatist separatists soldier soldiers strategic strategically tactics target targets territorial terror terrorism terrorist terrorists threat threats thwart thwart

7 COUNTERING TERRORISM WITH KNOWLEDGE James O. Ellis III Memorial Institute for the Prevention of Terrorism,Oklahoma City, Oklahoma,U.S.A. ([email protected])

CHAPTER OVERVIEW The study of terrorism is beset by many problems, ranging from the broad and dynamic nature of the phenomenon, the arrested development of applied research, and the disconnected databases covering the subject. The Memorial Institute for the Prevention of Terrorism (MIPT) seeks to enable better research on terrorism by developing and sharing pioneering information resources, including its Terrorism Knowledge Base. MIPT acts as a living memorial to the victims, survivors, rescuers, and family members of the bombing of the Alfred P. Murrah Federal Building in Oklahoma City on April 19, 1995. Serving the needs of emergency responders, counterterrorism practitioners, policymakers, and the public, MIPT conducts research into the social and political causes and effects of terrorism, and its mission is to expand and share knowledge to prevent terrorism or mitigate its effects.

141

142

1.

Chapter 7. Ellis

INTRODUCTION

In the information age, fighting terrorism means sharing knowledge. Simply sharing information is not enough; researchers must take stock of what we already know, build upon it, and develop credible and relevant policy recommendations to help manage the threat. Despite nearly four decades of research on terrorism, only now is the stage being set to help move this field of study into a more rigorous and revelatory discipline within the modern social sciences. Why do terrorism studies appear to have lagged behind other scholarly pursuits? A great deal of this arrested development stems from the problematic nature of the subject itself and the slow manner in which the field has evolved.

2.

PROBLEMS IN RESEARCHING TERRORISM

Terrorism is a difficult research subject. It is not a “homogenous activity;” the associated actors and activities vary widely over time and across the globe [17]. There is no universally accepted definition of terrorism and even when people agree on a definition, they sometimes disagree about whether or not the definition fits a particular incident or group. Placing terrorist activity within its larger political context can be challenging, as it often appears amongst other forms of violence during times of interstate war, rebellion, civil war, occupation, and military intervention [15]. Collecting data on terrorism can be trying, and the information is often imperfect. Determining who has perpetrated an act, whether a claim is credible, and if the attributed motives qualify it as a terrorist incident often bedevil even the most earnest of investigators [3, 10]. Likewise, the impact of these threats and violence usually go well beyond the immediate victims, nations, and regions in which they occur [2]. Terrorists typically do not control territory, wear uniforms, carry their weapons openly, function in discernable formations, or maintain permanent bases. Clearly, terrorism is not “a simple phenomenon with easy explanations and direct solutions” [17]. Changes in the nature of terrorism over the last fifteen years have made observing it more complex. In the heyday of the 1970s and 1980s, terrorist organizations consisted of a core, elite vanguard that conducted the violence, a more moderate, political wing, and a wider support network of fundraisers, volunteers, front groups, and safe house suppliers. Terrorist groups learned that it is easy to disable groups formed into corporate-style organizations with discernable power structures. Many groups now depend less on formal leadership and no longer maintain traditional hierarchies. This, in turn,

7. Countering Terrorism with Knowledge

143

requires less frequent communications and makes them much more difficult to spot, track, and intercept. Claims of responsibility for terrorist acts have also declined sharply [15]. Though traditional terrorist organizations still commit the majority of terrorist attacks using the standard tactics of bombing, assassination, armed assault, kidnapping, hostage-taking, and hijackings, other groups and individuals are increasingly responsible for terrorist violence and innovations. The classic conceptual model of recognizable, restrained, tightly-knit, professional, political organizations with clear aims appears to be breaking down in favor of groups and individuals with more varied and hazy objectives, shorter life spans, and a greater interest in violence for its own sake. Terrorism is increasingly perpetrated by amateurs and splinter groups, deemphasizing the organizational and ideological aspects of terrorism in favor of short-term interests and planning. Terrorist organizations have changed in size and structure. Though the number of groups has risen sharply, the number of members per group has dropped. The cost-effective nature of free-floating cells has rendered formal state support unnecessary. Many groups have moved toward a networked organizational structure, opting for highly decentralized decision-making and more local initiative and autonomy. Networks can be much more difficult to visualize, because they have fluid organization and infrastructure. When fighting a terrorist network, usually only small portions can be revealed and confronted at one time, presenting itself as a group of more or less autonomous, dispersed entities linked by advanced communications and perhaps nothing more than a common purpose. A network may simply absorb a number of attacks on its distributed nodes, leading observers to believe it has been harmed and rendered inoperable when, in fact, it remains viable and is seeking new opportunities for tactical surprise. Analytically, it is difficult to predict the proliferation of amateur terrorists and ad hoc cells of like-minded individuals seeking to conduct do-it-yourself warfare, briefly joining forces for come-as-you-are attacks and then disbanding. The shrinking size and organizational self-sufficiency of non-state terrorist groups limit their financial traces and the size of their footprint. The plans, motivations, and preferred targets of small terrorist organizations are less transparent than those with an established reputation and constituency. Lone zealots do not offer communications to intercept nor co-conspirators to capture for information about upcoming operations. Experts across academia, business, and government sectors have indicated that terrorism is becoming more amorphous, more complex, more sporadic, more amateurish, more difficult to predict, more difficult to trace, and more difficult to observe and analyze. Researchers and analysts require new methods and tools to help them make sense of such a complex threat environment.

144

3.

Chapter 7. Ellis

PROBLEMS IN TERRORISM RESEARCH

Terrorism studies was born an academic orphan with no midwife. It grew up in the “cracks and crevices which lie between the large academic disciplines” [17]; its foster parents were the schools of political science, history, psychology, sociology, anthropology, communications, criminology, law, economics, philosophy, and military science [18]. This interdisciplinary background has pushed terrorism research beyond the bounds of a single discipline, but it has also bred theoretical confusion [6]. With little consensus on concepts and typologies, there has been no clear home for terrorism studies in the academic literature. The literature of terrorism comprises dispersed and uncoordinated publications, with little distinction between the popular and the scientific, and evidence of “a very small core and a very large periphery” [4]. The absence of a large body of dedicated researchers has led to a lack of rigorous analysis and a focus on simple and seismic fluctuations in the phenomenon on terrorism. Several have noted that much of the published literature comes from transients – “researchers out for a once-off publication and who have no real interest in making a substantial contribution to the field” [16]. This is aided and abetted by the “aperiodic increase in attention paid to terrorism by the media, educators, and policymakers” [10]. Though the field of terrorism studies has roots back to the late 1960s, it has not matured as rapidly as it should have, due to a lack of data access, inhibited empiricism, and inadequate analytical tools. Terrorist organizations are notoriously difficult research subjects, as they usually operate covertly and are averse to exposing their organizational inner workings and leadership structure. Terrorists are rarely accessible for social scientific research on their group and individual dynamics, and data on their organizations is often classified [6]. Consequently, one of the best remaining options for studying these organizations and activities is by examining their exploits in the press and government reports. However, this has led to an over-reliance on secondary and state-produced material. Prior to the 1970s, most terrorism research presented case studies on particular groups and individuals. Unlike modern social scientists, most terrorism scholars still shy away from statistical and comparative research, opting for qualitative rather than quantitative analyses. Some have observed that the “majority of research on terrorism has been marked by theoretical generalizations based upon a lack of hard data” [8]. The majority of researchers depend entirely on data produced by others [16]. Part of this is because the cost of compiling and acquiring data is prohibitive. Still, many investigators are reluctant to share data, and most researchers try to “exhaust

7. Countering Terrorism with Knowledge

145

the utility of their datasets… and publish as much as possible from them until they make them public if they do so at all” [13]. Much of the earliest scholarship and data collection on terrorism, especially within the United States, focused almost exclusively on international terrorism – terrorism involving the citizens of more than one country. However, international terrorism only accounts for about one tenth of all recorded terrorist incidents [15]. This means much of the study of terrorism has blinded itself to up to ninety percent of its occurrence in the world. It is highly questionable to attempt to generalize about all terrorist behavior from trends seen in international incidents [10]. Indeed, the much described decline in the incidence of international terrorism over the last two decades does not appear to hold true when one combines this with domestic terrorism [15]. This type of international terrorism myopia often makes for unusual situations, such as when the National Counterterrorism Center was forced to count one of two Russian suicide plane bombings (simply because the flight included an Israeli citizen) but not the other. Since 9/11, terrorism research has increased dramatically but it often appears ahistorical, ignoring the literature and data from previous decades. Little research has looked at actual terrorist events [17]. Much of the current policy, research, and debate on terrorism does not examine what terrorists have actually been doing over the last four decades. While it is healthy and necessary to question pre-9/11 scholarship, perhaps even “wip[ing] the slate clean of the conventional wisdom on terrorists and terrorism” [5], we do ourselves a disservice by ignoring our intellectual forebears. Furthermore, we must work to supply a burgeoning crop of new terrorism specialists and counterterrorism professionals with the data and tools they need to understand this subject as never before.

4.

PROBLEMS IN TERRORISM DATABASES

In most social sciences, data is the coin of the realm. Since the 1950s, these disciplines have substantially increased their use of statistics and quantitative analysis [16]. Collaborative research, improved research methods, and shared databases have nurtured this growth in empiricism. The effective maintenance of databases in particular is crucial, since “databases can be used: A. As extended memory for the analyst; B. To discover underlying patterns of terrorism; C. To facilitate trend analysis; D. To compare terrorist campaigns cross-nationally and over time; E. To generate probability estimates of future terrorist activities;

146

Chapter 7. Ellis

F. To make statistical correlations with other phenomena that might be the causes, concomitants or consequences of terrorism; G. To evaluate the success of counter-terrorist policies” [15]. The primary advantage of using databases is “the ability to look at many factors simultaneously in a coherent fashion” [2]. Databases help researchers find answers to many questions. In terrorism research, datasets usually establish “who did what to whom and when” [2], though they are not as good at covering the why and how of terrorist events [17]. Despite the clear advantages that databases convey, many terrorism analyses have been largely “data impoverished” and, at times, “fact free” for several decades. While the ultimate goal is to develop monitoring and forecasting tools to better estimate trends in terrorist behavior [2], current databases can only give a general view of this behavior and should not be expected to predict that “the next attack will occur at site X in country Y next Tuesday at 11 a.m.” [10]. There are natural limits and tensions in building and maintaining terrorism databases. Data collectors invariably must balance “the desire for comprehensiveness with the necessity for rigor and relevance of the data” [3]. Due to the difficulties in tracking terrorism, many databases are drawn from media accounts, which may be affected by selective reporting coverage and gaps. By focusing on terrorists and their acts, many databases seem “generally detached from the overall political conflict situation in which the terrorist group is often only one of several actors” [15]. By attempting to exclude certain kinds of acts and actors, researchers must assume a certain amount of systematic bias, though this may be desirable [3]. Most terrorism databases are events databases, built upon previous chronologies. For the most part, terrorism databases are more like census databases (which attempt to collect data on every person) and less like public opinion polls (which generally select a specially defined ‘sample’ of individuals that represent a larger universe), meaning sampling methods are usually not used and missing incidents have been accidentally omitted [3]. This orientation means that most data collectors are bound to miss some, perhaps many, incidents in compiling their databases. The consistent application of a realistic working definition over time can also be very difficult to achieve [15], and most struggle in applying their definitions to specific cases [6]. The need for considerable resources and constant vigilance usually overtakes most data collection. As a result, there are frequent gaps and other discontinuities, because quite often a single researcher has been responsible for maintaining a database [15]. There are considerable differences between the various databases in existence. Some of these differences are to be expected, since many databases have been developed to meet the needs of particular missions or

7. Countering Terrorism with Knowledge

147

applications [3]. They often employ uniquely derived definitions and methodologies. However, this usually results in considerable differences of opinion as to what constitutes terrorism and significant variance in the numbers of incidents [15]. Much of this stems from questions of intercoder reliability and individual judgment. As Alex Schmid has noted, with regard to explaining these differences, “it is not only a question of who is counting, but also of what is counted and how” [15]. Most long-running databases have been maintained primarily by government agencies, research centers, and international organizations. Government data, in particular, is used quite frequently, though it is “inevitably influenced by political considerations” [6]. However, there may be greater neutrality and growing intellectual honesty in government reporting on terrorism. For example, the National Counterterrorism Center released data showing over 11,000 terrorist incidents in 2005, which averages to more than one attack per hour [11]. This is a far cry from the few hundreds of “significant” international terrorist incidents released in previous years by the U.S. State Department. Likewise, the British and French governments have also begun releasing compiled lists of terrorist attacks or databases. However, these data are usually rather limited in how they can be studied and manipulated, and many other databases provide information only in chronological order with little or no search engine capabilities [1]. Furthermore, terrorism databases are often cloistered, isolated, inaccessible, or languishing in obsolete computer programs. It is clear that unifying forces must coalesce if the field of terrorism studies is to overcome its state of arrested development and enjoy a research renaissance.

5.

MIPT AS AN INFORMATION CLEARINGHOUSE

The Memorial Institute for the Prevention of Terrorism (MIPT) is focused on expanding and sharing knowledge to prevent terrorism or mitigate its effects. The United States Congress directed MIPT to conduct “research into the social and political causes and effects of terrorism” and to “serve as a national point of contact for antiterrorism information sharing among Federal, State and local preparedness agencies, as well as private and public organizations dealing with these issues.” MIPT firmly believes that the accurate dissemination of knowledge on terrorism is a critical ingredient for combating it. We realized early on that a high priority need for terrorism research is the creation of authoritative and accessible databases. Therefore, some of the first research projects undertaken by MIPT were to create and maintain comprehensive electronic databases on terrorism-related subjects.

148

Chapter 7. Ellis

To this end, MIPT partnered with the RAND Corporation to improve the nation’s awareness of the history of and emerging trends in terrorism. By learning lessons from past incidents and grasping current trends, policymakers and scholars can better understand the nature of future threats and how to protect against them. MIPT serves the terrorism research community by offering access to a wealth of information resources including its terrorism databases, websites, and library collection. As there was no authoritative, central source of unclassified information on terrorism, MIPT worked to develop a world class collection of unclassified resources on terrorism, antiterrorism, and counterterrorism. With information and research on terrorism developing almost daily, creating and maintaining a comprehensive repository of that knowledge and data is a difficult task, which has become more daunting following the September 11th attacks. MIPT’s physical library houses thousands of books, videos, reports, articles, and pamphlets on terrorism and related subjects. It collects more than two dozen journals and bulletins, with complete sets of the two most influential journals in the terrorism field – Terrorism and Political Violence running since 1989 and Studies in Conflict & Terrorism dating back to 1977. MIPT also holds complete sets of the two most important U.S. government chronicles of international and domestic terrorism – the State Department’s “Patterns of Global Terrorism” (which has been replaced by “Country Reports on Terrorism”) and the Justice Department’s “Terrorism in the United States.” These have been made available electronically in their entirety for the first time through the MIPT website. The MIPT Terrorism Information Center employs numerous electronic resources like the Open Source Center (formerly the Foreign Broadcast Information Service), the Open Source Information System (OSIS), Nexis, and the Thompson/Gale E-encyclopedias. The library staff monitors approximately twenty-five listservs dealing with terrorism, first responders, emergency management, and weapons of mass destruction. MIPT also offers free access to an EBSCO database containing over 750,000 full text reports, articles and documents on terrorism and homeland security. Part of the OCLC interlibrary loan network, the Terrorism Information Center also provides an individual book lending program. Patrons can simply request an item by email, and it will be sent directly to the requestor with return postage included. Ultimately, MIPT intends to acquire all available English language material on terrorism and related subjects for onsite study by researchers, response practitioners, government agencies, and the public at large. A special effort is also underway to house scholarly archival collections from major terrorism experts. Some of the most valuable MIPT resources are a number of unique terrorism databases.

7. Countering Terrorism with Knowledge

6.

149

MIPT-FUNDED TERRORISM DATABASES

In 2000, MIPT began collaboration with RAND to create open, online databases that capture domestic and international acts of terrorism. This venture encompassed two databases – the RAND Terrorism Chronology and the RAND-MIPT Incident Database. The RAND Terrorism Chronology (also known as the RAND-St. Andrews Chronology) represents thirty years of research on international terrorism that RAND collected and maintained from 1968 to 1997. By working with MIPT, RAND has opened this large, proprietary database to the public for the first time. Though several excellent chronologies of terrorist events exist, other systems are limited in their ability to let users manipulate the data, drawing out, for example, only terrorism involving certain kinds of weapons, or certain groups or places, or any combination thereof. The RAND-MIPT Incident Database covers both international and domestic terrorism incidents worldwide from 1998 to the present day. These incident databases contain data from open sources and publications, collected by RAND. This collection process has been conducted in accordance with the same definition and vetting standards established at the beginning of the RAND Terrorism Chronology. An independent survey of terrorism databases by the Federal Research Division of the Library of Congress found these two databases “represent a very comprehensive and valuable resource of information on incidents of terrorism in the United States and abroad” [1]. In conjunction with the databases, RAND has produced biannual reports containing articles by subject matter experts, who draw heavily upon these databases. These publications offer contemporary analysis and insights, probe cross-cutting issues, and describe the terrorist threat environment. They are also intended to inspire others to take advantage of these tools in order to develop further knowledge. By keeping these databases open, objective, and online, MIPT affords researchers unparalleled access to a useful resource. MIPT also funds and hosts a robust database focused on terrorism-related trials in the U.S. Headed by the University of Arkansas, the MIPT Indictment Database compiles records related to federal criminal cases as a result of official FBI terrorism investigations under the Attorney General Guidelines from 1980 to present. The project provides a powerful quantitative dataset for researchers. The Indictment database includes information on nearly 500 suspected terrorists from about 60 groups indicted for over 6,000 federal criminal counts over the last 25 years. Approximately 75 variables can be analyzed, including: (1) demographic descriptions of indicted and convicted persons; (2) group type, affiliation, and ideology; (3) case and count outcomes (conviction, plea, acquittal, etc.); (4) and sentencing information. Analyses can be conducted on any combination of

150

Chapter 7. Ellis

these variables, and the source court records are also made available as Acrobat PDF documents. This material is invaluable in looking for preincident indicators or discovering more historical information about specific groups and incidents within the United States. It will also aid in the development of practical recommendations regarding the investigation, prosecution, and sanctioning of persons indicted for terrorism-related crimes. This data is being merged with powerful mapping tools to enable temporalspatial research on the planning, preparation, and execution of terrorist attacks, and MIPT hopes to provide this information to the public in the coming years.

7.

MIPT TERRORISM KNOWLEDGE BASE

In 2004, MIPT released the new Terrorism Knowledge Base (TKB) – www.tkb.org – to act as one-stop resource for comprehensive research and analysis on global terrorist incidents, terrorist organizations, and terrorismrelated trials. By combining its databases, library materials, and other resources into an in-depth, interactive system, MIPT has put the facts concerning global terrorism at the fingertips of policymakers, professionals, and the public. TKB covers the history, affiliations, locations, and tactics of terrorist groups operating across the world, with nearly 40 years of terrorism incident data and more than a thousand group and leader profiles. This system represents the most advanced, web-based tool of its kind. Users can search using directories, keywords, and more. Country profiles provide thorough background information, and group profiles describe bases of operations, founding philosophies, and current goals. They also contain Quick Facts, offering a snapshot of vital data and a “baseball card” of statistics for side-by-side comparisons. Key leader profiles display brief biographies, legal cases, and photographs where available. Most importantly, TKB offers highly interactive maps and sophisticated analytical tools that can create custom graphs and tables. The system provides remarkable analytical capabilities across a single, integrated knowledge base, including statistical summaries and trend graphing. Researchers can create all manner of graphs and charts examining incidents by region, by target, by tactic, by weapon, by group, by court case, and more. For less experienced users, the system includes a quick reference guide and a graphing wizard to walk them through the process of creating their own specialized tables, graphs, and maps. No other terrorism website provides such user-friendly features for free. The site has become very popular; at the time of this writing, the TKB was within the top ten websites for a Google search on “terrorism.”

7. Countering Terrorism with Knowledge

8.

151

BETTER KNOWING WHAT WE KNOW ABOUT TERRORISM

Some believe that after more than three decades of study, “we simply should know more about terrorism than we currently do” [16]. While I share this frustration, I believe we know more about terrorism than we realize, but we have hidden this knowledge away in disparate databases and disconnected research centers. Enabling open access to this knowledge is the most efficient way to redress the current problems and to attract more researchers. We must strive to support the “invisible college” that has attempted empirical inquiry with more data [7]. The vast majority of terrorism research is still conducted alone, with limited resources, by and for non-academicians [18]. Therefore, the research community should recognize terrorism data as a public good, like economic data, to be shared, debated, and dissected. Until now, statistical information on terrorism has been “generally unavailable to the public, inaccurate, dated, or limited to international or transnational events” [13]. By democratizing data and integrating both qualitative and quantitative information, we can develop new knowledge and bring greater empiricism to this field of study. Along with centralizing the published literature, institutes and government agencies should focus on sharing databases. Indeed, some believe that aggregating data on terrorist groups is probably the most useful way to test macrotheories about terrorism [12], and large databases can provide rigorous tests of the conventional wisdom [9]. As Alex Schmid states, “incident databases have, especially when compared to each other, much to say about the phenomenon of terrorism” [15]. Comparing databases may even help to uncover a common conception of terrorism. After all, though the definition debate has raged for decades, researchers have recorded tens of thousands of incidents. Wouldn’t it help us describe terrorism to compare and contrast what we have been counting all these years? We should work to reduce duplication of effort if possible, since it appears that “everyone seems to be collecting the same data over and over again” [3]. Twenty-five years ago, it was apparent that the increasing number of terrorism databases did “not necessarily reflect a substantial increase in the amount of information available about terrorism” [3]. All databases die or undergo changes in who maintains them and how they gather data as time passes and new technologies emerge. Without intervention, many datasets end up being integrated, becoming unavailable, or disappearing altogether. Some believe “a reliable master or comprehensive database could be created, one that integrates the MIPT data set with those that are linked to country-specific collection efforts” [14]. In this way, the Terrorism Knowledge Base could serve as a database

152

Chapter 7. Ellis

repository of sorts and encourage complementary rather than competitive collection efforts. Perhaps this could assuage the concern that “as long as the world of violence portrayed by one data set differs from the worlds of violence described by other data sets it is difficult to gain credibility outside the academic area” [15]. The terrorism research community should build upon existing consortia and databases, drawing together institutions based on their regional or functional specialties. MIPT prides itself on its ability to serve as a bridge linking like-minded institutions. In this endeavor, we should engage the Inter-University Consortium for Political and Social Research (ICPSR), the International Counter-Terrorism Academic Community (ICTAC), the International Relations and Security Network (ISN), and the Department of Homeland Security’s newly created University-Based Centers of Excellence. We should try to draw together past and present databases such as: · University of Maryland’s Global Terrorism Database (GTD); · International Terrorism: Attributes of Terrorist Events (ITERATE); · International Policy Institute for Counter-Terrorism/Merari database; · Monterey Institute’s WMD Terrorism database; · Int’l. Centre for Political Violence & Terrorism Research database; · Jan Engene’s Terrorism in Western Europe: Event Data (TWEED); · Jeffrey Ian Ross’ Attributes of Terrorism in Canada (ATIC) database; · Christopher Hewitt’s Domestic Terrorism database; · Marc Sageman’s Al-Qaeda database; · Robert Pape’s Suicide Terrorism database; · Robert Leiken’s Nixon Center Jihadi database; and · University of Auburn and Pennsylvania’s Eco-terrorism database Many other datasets should be added to this list. The Interuniversity Consortium for Political and Social Research offers a useful model, by preserving and providing access to an archive of social science data. However, terrorism data must serve a large body of non-academic researchers and analysts that are not affiliated with universities. Regardless of whether it is MIPT, ICPSR, the National Counterterrorism Center, or some other organization, someone needs to take the initiative in uniting these divided efforts. As a whole, we must become better at sharing information and share better information. Ultimately, the community must aim for the creation of new knowledge and enhanced understanding, so as to predict the emergence of similar events in the future [16]. We can ill-afford new intellectual blind spots like those that appeared before 9/11. The Terrorism Knowledge Base may provide a vehicle for improving the skills and awareness of the next generation of terrorism scholars and observers. It is incumbent upon us to take stock of the research that has gone before and to ensure its evolution going forward.

7. Countering Terrorism with Knowledge

9.

153

ACKNOWLEDGEMENTS

The Terrorism Knowledge Base is supported under Award Number MIPT-2003D-C-001, Terrorism Knowledge Base, from the Memorial Institute for the Prevention of Terrorism (MIPT) and the Office of Grants & Training, U.S. Department of Homeland Security. Points of view in this paper are those of the author and do not necessarily represent the official position of the U.S. Department of Homeland Security or MIPT.

REFERENCES 1. 2. 3. 4.

5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15. 16. 17.

Buchalter AR, Curtis GE (2003) Inventory and assessment of databases relevant for social science research on terrorism. Federal Research Division, Library of Congress Fowler WW (1980) An agenda for quantitative research on terrorism. Rand Corporation, Santa Monica, CA Fowler WW (1981) Terrorism data bases: a comparison of missions methods, and systems. Rand Corporation, Santa Monica, CA Gordon A (2004) Terrorism and knowledge growth: a databases and internet analysis. In: Silke A (ed) Research on terrorism: trends, achievements and failures. Frank Cass, London, pp 104-118 Hoffman B (2004) Foreword. In: Silke A (ed) Research on terrorism: trends, achievements and failures. Frank Cass, London, pp xvii-xix LaFree G, Dugan L (2004) How does studying terrorism compare to studying crime? Law and Deviance, vol 5: 53-74 Mickolus EF (1977) Statistical approaches to the study of terrorism. In: Alexander Y, Finger SM (eds) Terrorism: interdisciplinary perspectives. John Jay Press, New York Mickolus EF (1981) Combating international terrorism: a quantitative analysis. Ph.D. dissertation, Yale University Mickolus EF (1987) Comment – terrorists, governments, and numbers: counting things versus things that count. Journal of conflict resolution, vol 31, no 1: 54-62 Mickolus EF (2002) How do we know we're winning the war against terrorists? issues in measurement. Studies in Conflict & Terrorism, vol 25, issue 3: 151-160 National Counterterrorism Center (2006) Country reports on terrorism 2005, statistical annex. Ross JI (1988) An events data base on political terrorism in canada: some conceptual and methodological problems. Conflict Quarterly, vol III, no 2: 47-65 Ross JI (2004) Taking stock of research methods and analysis on oppositional political terrorism. The American Sociologist, Summer: 26-37 Ross JI (2006) Political terrorism: an interdisciplinary approach. Peter Lang Publishing, New York Schmid AP (2004) Statistics on terrorism: the challenge of measuring trends in global terrorism. Forum on Crime and Society, vol. 4, nos 1 and 2: 49-69 Silke A (2001) The devil you know: continuing problems with research on terrorism. Terrorism and Political Violence, vol 13, no 4: 1-14 Silke A (2004) An introduction to terrorism research. In: Silke A (ed) Research on terrorism: trends, achievements and failures. Frank Cass, London, pp 1-29

154

Chapter 7. Ellis

18. Silke A (2004) The road less travelled: recent trends in terrorism research. In: Silke A (ed) Research on terrorism: trends, achievements and failures. Frank Cass, London, pp 186-213

SUGGESTED READINGS · Jeffrey Ian Ross (2006). Political terrorism: an interdisciplinary approach. Peter Lang Publishing, New York. · Alex P. Schmid and Albert J. Jongman (2005). Political terrorism: a new guide to actors, authors, concepts, data bases, theories, & literature. Transaction Publishers, New Brunswick, New Jersey. · Andrew Silke (ed) (2004). Research on terrorism: trends, achievements and failures. Frank Cass, London.

ONLINE RESOURCES · MIPT Terrorism Knowledge Base www.tkb.org · Centre for the Study of Terrorism and Political Violence http://www.st-andrews.ac.uk/academic/intrel/research/cstpv/ · International Centre for Political Violence and Terrorism Research http://www.pvtr.org/ · International Policy Institute for Counter-Terrorism http://www.ict.org.il · Jane’s Terrorism and Insurgency Centre http://jtic.janes.com · Monterey Institute Center for Nonproliferation Studies http://cns.miis.edu/dbinfo/about.htm · National Consortium for the Study of Terrorism & Responses to Terrorism http://www.start.umd.edu/ · South Asia Terrorism Portal http://www.satp.org · Terrorism Research Center http://www.terrorism.com · Worldwide Incidents Tracking System http://wits.nctc.gov

7. Countering Terrorism with Knowledge

155

DISCUSSION QUESTIONS 1. Is historical information of little use to understanding the current terrorist threat? 2. Do perceptions of the amount and intensity of global terrorism match empirical data? 3. Where do you seek objective and comprehensive coverage of the subject of terrorism? 4. How can one present a fair picture of the current state of terrorism? 5. What types of data inform you most without hyping the threat?

8 TOWARD A TARGET-SPECIFIC METHOD OF THREAT ASSESSMENT Yael Shahar Institute for Counter-Terrorism, Interdisciplinary Center, Herzliya, Israel ([email protected])

CHAPTER OVERVIEW This chapter describes a threat assessment model used at ICT to estimate the “attractiveness” of specific facilities to terrorist organizations. The model uses on-site evaluations of vulnerabilities to build a portfolio of possible attack scenarios. The scenarios are then analyzed using known or estimated sensitivities and target-assessment criteria for the different organizations. The results provide a means of rating the different scenarios according to their attractiveness to different types of terrorist groups. This will enable decision-makers to concentrate resources on the most the probable scenarios, rather than on worst-case scenarios. The model has provided credible results for actual venues.

157

158

1.

Chapter 8. Shahar

INTRODUCTION

An accurate estimation of the threat posed by terrorism is of the utmost importance in deciding whether – and how much – to enhance security at a given venue. The stages in preparing an operational counter-terrorism plan are: first, to identify those groups or individuals that are both motivated and capable of attacking the facility under consideration (threat assessment); and second, to review existing security precautions in light of this knowledge, based on the known vulnerabilities of the venue (risk analysis). The overall process of threat assessment is particularly complex in that the threat posed by any given terrorist organization will reflect its estimate of the venue’s attraction as a target and the ease of attacking it. In other words, the threat assessment depends on the risk analysis as much as the risk analysis depends on the threat assessment. In reality, this interdependence is rarely taken into account; practical, political, and economical circumstances generally bring about a fragmentation of effort, with threat assessments carried out at a national or regional level, without any consideration of the characteristics of the venue under consideration. Likewise, risk analyses are generally not based upon the same considerations as the threat assessment. In effect, the two procedures often appear to be based on totally different sets of assumptions. The venue-specific risk assessment model discussed here is designed to integrate these two aspects of security planning. This model estimates the “attractiveness” of specific facilities to specific terrorist organizations. Its utility lies in its ability to help security planners categorize possible attacks in terms of most probable vs. most damaging. In the absence of empirical data on threats, planners and pundits often fall back on “worst case” scenarios. However, this has often meant the over-allocation of resources to some of the least likely attack scenarios. Preparing for the “low risk / high consequence” attack is not the only (or even the best) approach. Scarce resources can be better exploited if a way is found to classify threats according to likelihood, and not just according to the severity of consequences.

2.

METHODOLOGY

The probability of a terror attack on a particular target is dependant not only on the characteristics of the target—its symbolic or strategic value and its vulnerabilities—but also on the ambition, capabilities, and sensitivities of the relevant terrorist organizations. In the sections that follow, I’ll present an overview of a statistical method

8. Toward a Target-specific Method of Threat Assessment

159

for evaluating the threat presented by different types of terrorist groups to particular venues. The method builds on input regarding the known characteristics of the terrorist groups active in the region in question, combined with the characteristics of each potential modus operandi. The goal is not so much to give a precise prediction of who, how, and where; but rather to provide a better basis for deciding how best to allocate finite counter-terrorism resources. The stages used in the proposed model are: 1. Determination of Organization-specific factors – We determine which organizations present the greatest threat to the venue in question, based on the motivations, capabilities, and ideologies of the organizations. Each organization is given a Risk Score, based on the relative score of each index applied to that organization. The analysts running the model determine the threshold above which organizations will be included in the model. 2. Determination of Venue-specific factors – An exhaustive analysis of the vulnerabilities of the venue in question is carried out by a professional security team. For most high-profile venues, this analysis will already have been performed by the installation’s security personnel as part of their routine duties. Care must be taken to examine the vulnerabilities of the venue in question from the point of view of the potential attacker— seeking weaknesses that might be exploited to carry out an attack. 3. Scenario building – the information on venue vulnerabilities is combined with data on potential scenarios. In our model, the list of scenarios is taken from a database of hundreds of potential terror attacks, chosen in accordance with the vulnerabilities of the venue in question. Each scenario will be given a score based on the difficulty of carrying it out and the potential damage of a successful attack. 4. Numerical synthesis – Combining the results of the last three stages, we arrive at a numerical evaluation of the likelihood that any particular type of attack will be carried out by a particular terrorist organization. We do this by categorizing the various scenarios according to the targetselection methods of the different organizations: for example, the difficulty of successfully perpetrating the attack and the desirability of the outcome of the attack from the point of view of the terrorist organization. For each terrorist organization, we include factors to weigh the terrorists’ sensitivity to these attack-specific factors. The result is a score that indicates the net “attractiveness” of a particular type of attack to a particular type of organization. For example, some organizations may be more deterred by physical difficulty or by attacks requiring years of planning, while others would be undeterred by these factors. Somemay see achieving maximal casualties as a central goal, while others may be

160

Chapter 8. Shahar

unwilling to risk causing high casualties. Naturally, the resulting numbers are only as good as the information that goes into the model. In effect, the model should be viewed as merely a template for better organizing our knowledge; without that knowledge, the template is empty of all content. However, when based on reliable information, the model is a very useful tool for data visualization and risk assessment.

3.

ORGANIZATION-SPECIFIC INDICATORS

For the purposes of illustration, we will base the following example on a tourist venue in the United States. An analysis of organizations in the ICT database and their characteristics leads us to believe that the greatest threat to tourist sites in the United States is likely to be posed by groups or cells having the following characteristics:

3.1

Structure and Reach

· Supported by a state or sub-state entity. The stronger such support, the greater the resources at the disposal of the group, and the more ambitious a potential attack is likely to be. · Loose network affiliated with other like-minded cells or groups around the world. Such international connections are particularly useful in the planning stages of an attack, and facilitate the escape of those directly involved in supervising and perpetrating the attack. Groups posing the greatest danger are those with a broad-based support system around the world. Such a support system often consists of fundraising and political activists living outside the group’s normal sphere of operations. · Is able to blend in with immigrant groups in the target country. Because of the need for extensive planning and pre-operational intelligence, the members of a potential attack cell would be required to spend long periods under cover inside the target country. Connections with a particular ethnic group within that country could greatly facilitate the existence of “sleeper” cells. 3.1.1

Motivation

· Motivated by religion or quasi-religious ideology. This entails a preference for mass-casualty attacks, as well as the potential to carry out suicide attacks. Such organizations may share some of the characteristics of apocalyptic cults.

8. Toward a Target-specific Method of Threat Assessment

161

· Shows past history of hatred of the target country/countries. Most terrorist groups are fairly vocal about their agenda, in order to recruit like-minded individuals to their camp. Although not all vocally antiWestern groups pose a threat, it is probable that those that do pose a threat will make no secret of their intentions. · Has been, or expects to be, targeted by the country under consideration.. Potentially the most dangerous groups to our venue are likely to be those directly affected by the policies of the country under consideration. In the past, this meant that the groups to worry about would be those adversely affected in some way by the target country’s foreign policy. However, in light of the U.S.-led campaigns in Afghanistan and in Iraq, we can expect the circle of those with an axe to grind against the U.S. and its allies to have grown considerably wider. Because of the inter-relatedness of the threat, the potential risk is spread out among dozens of semi-autonomous organizations in a number of countries. Many of these countries are not themselves in any way directly affected by the U.S. campaign. 3.1.2

Characteristics of Past Attacks

· Has carried out attacks outside its local sphere of influence. Often, this is a function of how much assistance the group receives from a state or substate sponsor. Those foreign-based organizations that have demonstrated capability to act far from their home ground are naturally to be considered of greater threat. · Has carried out attacks against similar targets. For example, an organization that has singled out tourism targets for attack is one whose goals generally include inflicting economic damage on the target country. This is true of some domestic groups, such as ETA, as well as of international terrorist groups. However, organizations that single out tourist sites popular with international travelers generally have a more globe-spanning goal. International tourism-related targets are often chosen because they represent the antithesis of the terrorists’ own worldview: they stand for openness, diversity, and globalization. · Has carried out attacks against targets or interests belonging to the country under consideration. For example, a history of attacks on American targets indicates not only a pre-existing enmity toward the United States, but more importantly, a readiness to transform this enmity into action. These indicators of potential threat will be given a relative weight according to the proportional contribution to a given organization’s potential to attack similar targets in the target country. Table 8-1 shows one example

162

Chapter 8. Shahar

of how these indicators might be chosen in the case of a tourism-related venue. Table 8-1. Organization-specific indications of potential threat Indicator Structure and Reach Supported by a state or sub-state entity. Part of international network of groups or cells. Ability to blend in with immigrant groups in the United States. Attack History Past history of attacks outside its own sphere of influence. Past history of attacks against similar targets Past history of attacks against American interests Motivation Motivated by religion or quasi-religious ideology. Has threatened to attack American interests. Has been, or expects to be, targeted by the target country.

Relative Weight 20 15 10 Max: 45 15 10 5 Max: 30 15 5 5 Max: 25

The values of the variables chosen here are not necessarily the values that would be used for an actual threat assessment. Since we have not specified a real venue, we are using these values as an example only. The exact values of the variables would be determined by the researchers according to the nature of the venue under consideration. The total of all the variables should equal to 100.

3.2

Example of Organization Input

Table 8-2. Gama’ah al-Islamiya: Relative risk from analysis of indicators Structure and Reach 0 Supported by a state or a sub-state entity The Egyptian Government believes that Iran, Bin Ladin, and Afghan militant groups have all provided financial support to the Gama`ah al-Islamiyya. However, the group does not benefit from significant state-sponsorship. Part of an international network of like-minded groups and cells 5 The Gama`ah al-Islamiyya operates mainly in southern Egypt, and in urban centers. However, the group has been indirectly involved in international terror, through ‘Arab-Afghans’ (Egyptian citizens who trained in the Mujahideen camps after the end of the war) who operate as individuals within autonomous Islamic terrorist cells abroad. Such cells exist in Sudan, the United Kingdom, Afghanistan, Austria, and Yemen. Ability to blend in with immigrant groups in the United States 5 Other than a small group of radicals, the Islamic Group has only a limited presence in the United States. However, the group has been known to run fundraising operations in the U.S. and in Canada.

8. Toward a Target-specific Method of Threat Assessment

163

Attack History 15 International terrorist activity From 1993 until the cease-fire, al-Gama`ah carried out attacks on tourists in Egypt, most notably the attack at Luxor that killed 58 foreign tourists. The Egyptian organizations, predominantly Al-Gama`ah al-Islamiya, were indirectly involved in international terror, through ‘Arab-Afghans’ operating as individuals within autonomous Islamic terrorist cells abroad. Attacks carried out, or claimed by these cells, include a suicide bomb attack against the police station in Rijeka, Croatia (October 1995) and the attempted assassination of Hosni Mubarak during his visit to Ethiopia (June 1995). The Gama`ah has never specifically attacked U.S. citizens or facilities, and has not conducted an attack inside Egypt or abroad since August 1998. 10 Attacks against tourism-related interests Until the ceasefire, GIA was known for its attacks on tourism in Egypt. However, the organization has not attacked tourist targets outside of Egypt. 2 Attacks against American Targets American tourists were attacked in Egypt, along with nationals of other countries. Motivation Motivated by religious ideology 15 The Islamic Group was greatly influenced by the militant ideology of Sayyid Qutb. The blind Egyptian cleric, Sheikh Omar Abdel Rahman, the supreme spiritual authority of Al-Gama`ah al-Islamiya and the Egyptian ‘Jihad,’ issued a fatwa sanctioning terrorist activity. Has expressed willingness to attack Western interests 5 The group has sided with Osama bin Ladin in the past, including signing his 1998 fatwa calling for attacks on U.S. civilians. While the Gama`ah’s traditional goal was the overthrow of the Egyptian Government, Taha Musa’s faction has expressed an interest in attacking U.S. and Israeli interests. Targeted by U.S. anti-terrorism campaign 5 The U.S.-led campaign may have cut off some of the group’s funding, and driven Musa Taha, the leader of the radical faction, out of Afghanistan. The US treasury has added the GI to the list of groups targeted by economic sanctions. Overall relative risk: 62

A similar analysis would be carried out for each organization deemed to present a potential threat. Those having the highest overall risk score would be those used in the analysis that follows. The organization above would most likely not be one of those included in the analysis, due to its relatively low risk score.

3.3

Venue-specific factors affecting target selection

In order to evaluate the net “attractiveness” of a particular type of attack to a particular type of organization, each type of attack receives a combined

164

Chapter 8. Shahar

Difficulty score, as well as three separate Impact scores, as shown below in Table 8-3: Table 8-3. Attack-type parameters Parameters Difficulty, based on: Planning time required Resources required Physical difficulty Impact, based on: Physical/economic damage Casualties Symbolic value (includes psychological impact)

3.4

Relative Weight 33 33 33 33 33 33

Example scenarios

The following scenarios illustrate how these factors are applied to particular scenarios. Since we are not dealing with a particular venue in these examples, these samples are very general in nature. An actual threat assessment would require that the specific vulnerabilities of the venue be factored into the scenario rating. Remotely detonated bomb This is the simplest type of attack and requires only moderate investment. However, in order for this type of attack to be successful, the organization must carry out at least minimal pre-operational intelligence to determine the best time and location for bomb placement. For example, if the intention is to inflict casualties, the bomb will need to be set in an area with heavy traffic and time to go off during working hours. On the other hand, if the aim is to gain media attention without causing casualties, then the bomb might be placed in the same area at midnight. Bomb in public area Leave bomb package in lobby or in garbage container.

A bomb placed in a travel bag or plastic bag is left in a public area or in a garbage container. The bomb can then be activated by timer or remote control mechanism.

Planning time: 20 Resources: 10 Difficulty: 10

Result: Possible large damage to property; Disruption of operations for short while; Possible moderate number of casualties

Physical/Economic Damage: 25 Casualties: 20 Symbolic: 25

8. Toward a Target-specific Method of Threat Assessment

165

Suicide attacks The human bomb is extremely motivated either by ideological and/or religious impulses. His/Her main aim is mass killing and destruction, without regard for his or her own life or the lives of others. Spiritually, these people are ready to die, and as a result they are usually calm and determined. Until they get to the specific spot where they will operate the explosives, only a highly trained eye would notice anything suspicious. Such a human bomb can approach any public facility—particularly a crowded place such as a bar or restaurant—and operate a charge of a few dozen kilograms. Such charges are usually stuffed with nails and shrapnel, in order to maximize casualties and loss of limbs. The effects of this type of bombing are generally limited by the amount of explosives that the attacker can carry into the target zone. However, unlike a static charge, the attack can choose both the time and the place of detonation, thus maximizing damage and casualties. Suicide bomb Suicide bomber

A suicide bomber conceals the explosives on his body or in a bag and manually activates the device. Result: Possible large number of casualties; Closure of facility for several days / weeks

Planning time: 20 Resources: 15 Difficulty: 15 Physical/Economic Damage: 25 Casualties: 25 Symbolic: 25

Carbomb attack on main entrance or external walls An additional and potentially even more devastating kind of attack would be to break into the lobby of a public building with a carbomb. We’ve seen the effects of such an attack at the American embassy in Beirut, in some Israeli official facilities in Lebanon and the bombings of the American embassies in Kenya and Tanzania, not to mention the more recent attacks on the Marriot Hotel in Jakarta and the Taba Hilton Hotel in the Sinai. Such a vehicle can carry a few hundred kilograms of explosives. Operating such a charge at the center of the building will cause many casualties and large-scale damage to the structure. Terrorists are well aware of the potential impact of this type of attack; it is exactly the sort of outcome they aim for. The fall of the World Trade Center towers in NYC illustrates the possible result far better any other description.

166

Chapter 8. Shahar

Suicide Car bomb attack on lobby / external wall Explosives-laden vehicle attack on public building.

Drive a car or truck filled with explosives into the entrance or lobby. (This was the method used in the attack on the Hilton Hotel in Taba in October 2004.) Result:Possible large number of casualties; Closure of building for several weeks / months

Planning time: 20 Resources: 20 Difficulty: 15

Physical/Economic Damage: 30 Casualties: 28 Symbolic: 25

More “professional” terrorists could carry out a carbomb attack by crashing the vehicle into the lobby through the main entrance, leaping out of the vehicle (an action requiring no more than 30 seconds) and escaping through a secondary entrance while everyone in the vicinity is in shock. The explosives can be detonated a few minutes later by timer or remote control. Carbomb in underground parking lot One of the most vulnerable and crucial weak points of many public building is the underground parking lot. In many cases, these parking lots are open to the public, and there is no control whatsoever over who parks there. Some of the cars may be parked in the lot on a permanent basis, either daily or periodically. It would be extremely easy for hostile elements to park a vehicle packed with a few hundred kilograms of explosives, which could be timed to detonate after the perpetrators have left the country. In quite a few cases, the layout of underground parking lots allows a vehicle to be parked near the main load-bearing pillars of the building. A very large charge detonated in such a place could cause major damage, many casualties, and at the very least, disruption of operations for a long time. Structural damage could be serious enough to lead to the complete closing of the facility, if not to even worse consequences. A regular sedan type car is capable of carrying a few hundreds kilo of explosives. Such a charge can be operated by timer or remote control mechanism. A blast of a few hundred Kilos will shock the entire building. There is no doubt that the blast wave will impact the entire building. Depending on the exact location of the blast, it is possible that a section of the building will collapse as well.

8. Toward a Target-specific Method of Threat Assessment

167

Car bomb – underground car park Place car or small truck loaded with high explosives or a gas container in car park – detonate by timer or remote control.

One or more vehicles are bought, hired, or stolen. The vehicles are packed with explosives or gas tanks and parked in the underground parking, in a location designed to cause maximum structural damage. The vehicles are detonated using remote control devices or timers. Result: Possible large number of casualties; Possible major/total structural damage; Disruption/ cessation of operations

Planning time: 25 Resources: 25 Difficulty: 28

Physical/Economic Damage: 33 Casualties: 33 Symbolic: 33

Indiscriminate shooting attacks Indiscriminate shooting attacks aim to kill as many people as possible, regardless of who they are. Such a method can be executed in a number of ways, among them, entering the building and opening fire, shooting from a moving vehicle, etc. One of the main problems facing security authorities in many countries is the fact that they are not allowed to carry weapons themselves. This means that in the case of a shooting attack, the chances of effective return fire are slim. The security staff can only attempt to minimize the damage by preventive measures and by damage control after the attack is over. In such a scenario, time lost equates to lives lost. Since the security staff cannot respond, the attackers will have a free hand to continue the attack; civilians are similarly unarmed and will thus not be able to stop the attack. Any emergency plan should include a response to such an attack, including evacuation of wounded and direction of people to a shelter. Shooting attack in public building (eg. Shopping Mall) Use automatic weapons and explosive in crowded public area.

Terrorists enter the building with weapons concealed in bags or under coats. The gunmen open fire and throw grenades. A hostage scenario can evolve from here, or the operation can be a suicide attack, ending with a firefight with the authorities and the eventual death of the attackers. If the building has entrances to other public areas, it would be easy to move from one location to the other. Result: Possible large number of casualties; Closure of the facility for several hours / days; Creation of an incident in which security personnel may shoot at each other.

Planning time: 5 Resources: 10 Difficulty: 15

Physical/Economic Damage: 15 Casualties: 20 Symbolic: 15

168

Chapter 8. Shahar

Obviously, the list of potential scenarios is huge. It is the job of the onsite investigative team to come up with as many potential attacks as possible based on the venue’s vulnerabilities.

3.5

Evaluation of organizational sensitivities

Each category of terrorist organization receives four “sensitivity” scores, as shown in Table 8-4. These scores will be combined with each attacktype’s Difficulty and Impact factors to determine the importance of these factors to the organization type. When the resulting “Weighted Difficulty” is subtracted from the resulting “Weighted Impact,” the result is the “Attractiveness” of that attack to that organization type. Table 8-4. Sensitivity parameters (Negative interest indicates aversion to causing this type of damage.) Parameters Range Sensitivity to difficulty 0 – 100% Interest in causing physical/economic damage -100% – 100% Interest in causing casualties -100% – 100%

As mentioned above, the organizations selected for analysis will be those having the highest overall threat score, estimated in Stage 1. Based on our familiarity with the characteristics of these organizations, we can estimate their sensitivities. Table 8-5 below shows a sample of such a categorization; since we have not specified a venue, we will use group types, rather than actual organizations, for the analysis. Note that this table is based only on a generic analysis; in order to be truly effective, it would require far more parameters than those shown — an analysis that is beyond the scope of this paper. Table 8-5. Organization-type sensitivities Al-Qaida “Central” Sensitivity to 25% Difficulty Interest in Physical / 100% Economic Damage Interest in Casualties 100% Interest in Symbolic 100% Value of Targets

Local Islamists 60%

Ad hoc Groups 90%

60%

95%

80% 100%

-70% 90%

8. Toward a Target-specific Method of Threat Assessment

4.

169

SYNTHESIS

Putting all these factors together, we can derive the following numerical breakdown, indicating the attractiveness of specific types of attack to the groups discussed above. Table 8-6. Numerical Synthesis Attack Type Al-Qaida Central Open Space Bomb 60 Restaurant Bomb 58 Suicide Bomb 63 Suicide Car Bomb 69 Static Car Bomb 54 Car-Park Bomb 80 Open Space Shooting Spree 43 Mortar/Missile Attack 16 Food Poisoning 23 Bio-Agent in Food 34 Explosive BioDevice 57 Pressurized BioDevice 55 Bio-Agent in A/C 53 Bio-Agent in Fire Sprinklers 52 Suicide Bio-Aerosol 54 Leave Radioactive Substance 40 Radioactive in A/C 33 Crash Private Plane 27 Arson 20

Local Extremist Groups 32 25 30 32 16 32

Ad hoc Groups

22

-4

-9 0 -1

-29 -15 -32

16

-24

13 7

-28 -36

4 15

-40 -16

6 -11 1 7

-25 -47 -11 1

8 -8 -3 -3 -20 -13

170

Chapter 8. Shahar

A graph of this information provides a more visually satisfying view of the data:

Arson Crash Private Plane Radioactive in A/C Leave Radioactive Suicide Bio-Aerosol Bio-Agent in Fire Bio-Agent in A/C Pressurized BioExplosive Bio-Device Bio-Agent in Food Food Poisoning Mortar/Missile Attack Open Space Car-Park Bomb Static Car Bomb Suicide Car Bomb Suicide Bomb Restaurant Bomb Open Space Bomb 0

10

20

30

40

50

60

70

80

90

100

Figure 8-1. Attacks attractive to al-Qaida “Central”

Arson Crash Private Plane Radioactive in A/C Leave Radioactive Suicide Bio-Aerosol Bio-Agent in Fire Bio-Agent in A/C Pressurized BioExplosive Bio-Device Bio-Agent in Food Food Poisoning Mortar/Missile Attack Open Space Car-Park Bomb Static Car Bomb Suicide Car Bomb Suicide Bomb Restaurant Bomb Open Space Bomb -20

0

20

40

60

Figure 8-2. Attacks attractive to local Islamist extremists

80

100

8. Toward a Target-specific Method of Threat Assessment

171

Arson Crash Private Plane Radioactive in A/C Leave Radioactive Suicide Bio-Aerosol Bio-Agent in Fire Bio-Agent in A/C Pressurized BioExplosive Bio-Device Bio-Agent in Food Food Poisoning Mortar/Missile Attack Open Space Car-Park Bomb Static Car Bomb Suicide Car Bomb Suicide Bomb Restaurant Bomb Open Space Bomb -60

-40

-20

0

20

40

60

80

100

Figure 8-3. Attacks attractive to al hoc groups

5.

SUMMARY: SCENARIOS MOST LIKELY TO BE CARRIED OUT BY RELEVANT TERRORIST GROUPS

As described above, we have attempted to establish criteria for judging which attack scenarios might prove “attractive” to the various categories of terrorist groups that might be interested in attacking the venue in question. As our judgments regarding the affinities and sensitivities of these groups are necessarily approximate, and our judgments as to the difficulties and impact of the various forms of attack are not necessarily the same as the judgments made by the terrorists themselves, the specific numbers and rankings should be taken only as a general guide. Nonetheless, we can draw some conclusions from the analysis: The most “attractive” types of attack for al-Qaida and its associates are “high quality” explosive attacks—particularly car-park bombings aimed at destroying or severely damaging the entire facility. Many other types of attack are reasonably “attractive” as well, but there is no pressing reason for these organizations to use non-conventional weapons where explosives will serve well enough. Local extremist groups are likely to select from a smaller menu of attack types; they are most likely to carry out bombings or shooting attacks, but may also attempt a low-level non-conventional attack.

172

Chapter 8. Shahar

Ad hoc groups, on the other hand, should not find a tourist venue to be all that attractive a target. As most of the attack scenarios we envision involve significant casualties, and input data was based on the assumption that these groups generally prefer to avoid killing many people, it would seem that the venue should not be high on their list of targets. However, should one of these groups nevertheless choose our venue as a target, certain types of attack are likely to be more attractive than others. For example, they may elect to perform bombings with warnings phoned in before the explosives detonate, in order to cause large-scale damage while minimizing casualties. As such an attack has in fact occurred at tourist venues in the past, we must assume that it can happen again. Further Enhancements – Advanced Data-Mining Capabilities This method can be further enhanced to include data-mining abilities using open source information and building on the ICT database of terrorist incidents. This raw data would provide the basis for a continual reevaluation of the organizational factors that enter into the equation, as well as the availability of resources that could be used in the perpetration of certain types of attack. The result will be a dynamic threat assessment apparatus which could be programmed to “flag” certain types of incidents and organization when the relevant threat indices reach a critical level. This enhancement would build on current data-mining technologies and off-the shelf database tools. The end product would be applicable to governments, installation security, public transport officials, and a host of other sectors that could be targeted by terrorists. The enhancement of the model to include advanced data-mining technologies will enable the model to become self-adjusting to changes in terrorist organization make-up, local circumstances, and political realities.

6.

CONCLUSION

The value of the model discussed here lies not in its ability to reveal new information, but rather in its usefulness as a planning and pedagogical aid: a means to visualize data so that trends may be readily apparent where they might otherwise have been lost in a sea of data. Such data-visualization tools are important in helping us better manage our resources. While the model’s methodology is quite general, the particular target characteristics generate very specific risk vs. impact numbers for that target. We have used this model for evaluating threat / impact risks for tourist and transportation facilities with credible results. The end goal is to turn this model into a computational apparatus that can be used by those responsible

8. Toward a Target-specific Method of Threat Assessment

173

for installation security, who may not have extensive knowledge of the terrorist groups most likely to target their facility. This will require extensive data-mining capabilities to allow the model to “self-adapt” and “learn” from open source material. However, any such model, and the intelligence on which it is based, should be seen as only one component in the fight against terrorism. We must never forget that terrorism is psychological warfare and that its real target is not one venue or another, but the targeted society as a whole. Thus, a significant portion of our resources must go toward thwarting the effectiveness of terrorism as a whole. Terrorism works somewhat like a virus; by hijacking society’s own means of communication—the news media—terrorism succeeds in disseminating its own messages. In a sense, the media plays a multi-level role in the chain of terrorism effectiveness—it carries scenes of death and destruction into the homes of every member of society, while at the same time carrying the fears and anxieties of society to the ears of the terrorists. By telling the terrorists what we are most afraid of, we play an active role in their selection of targets and modes of attack. We can weaken the effectiveness of terrorism as a tool for policy-making by informing the public of the real extent of the threat. In helping citizens understand what terrorists can and cannot do, and what the individual can do to defend his or her society, we undermine the efficacy of terrorism while strengthening the ability of our society to withstand the threat of terrorism. It is up to us to see that this information reaches both the media and the citizenry.

SUGGESTED READINGS · Ganor, Boaz (2005). The Counter-Terrorism Puzzle: A Guide for Decision Makers. Transaction Publishers. · Hoffman, Bruce (2006). Through Our Enemies' Eyes: Osama Bin Laden, Radical Islam, And the Future of America. Potomac Books; Revised edition. · Cragin, Kim (2004). “The Dynamic Terrorist Threat an Assessment of Group Motivations and Capabilities in a Changing World.” RAND Corporation · Jackson, Brian A. et al. (2005). “Aptitude for Destruction: Organizational Learning in Terrorist Groups and Its Implications for Combating Terrorism.” RAND Corporation · Sageman, Marc (2004). Understanding Terror Networks. University of Pennsylvania Press

174

Chapter 8. Shahar

ONLINE RESOURCES · Memorial Institute for the Prevention of Terrorism (MIPT). Terrorism Knowledge Base (TKB). TKB provides in-depth information and tools on terrorist incidents, groups, and trials. http://www.tkb.org · Terrorism Threat Assessment Resources, Intelligence Resource Program, Federation of American Scientists. ttp://www.fas.org/irp/threat/terror.htm · LaFree, G., Dugan, L., Fogg, H.V., Scott, J. (2006). Building a Global Terrorism Database. The report provides an analysis of several terrorism databases. PDF file, 209 pages. http://www.ncjrs.gov/pdffiles1/nij/grants/214260.pdf

DISCUSSION QUESTIONS 1. How would one go about testing the model described in this chapter? 2. What are the risks inherent in relying solely on models such as the one discussed here? How might these risks be minimized? 3. To what degree does the model discussed here depend on the expertise and knowledge of the analyst? Which inputs could be deemed “objective” and free of the personal opinions of the analyst and which are by nature subjective? 4. Might there be a way of “automating” the model so that it could be used by laymen? What risks would this pose to the accuracy of the resultant conclusions? 5. How might the organization-specific factors change if we were dealing with threats from domestic groups rather than international ones?

9 IDENTIFYING AND EXPLOITING GROUP LEARNING PATTERNS FOR COUNTERTERRORISM Horacio R. Trujillo1 and Brian A. Jackson2 1

Research Fellow, RAND Corporation, Santa Monica, California, U.S.A. ([email protected]); Associate Director, Homeland Security Program, RAND Corporation, Arlington, Virginia, U.S.A. ([email protected])

2

CHAPTER OVERVIEW In this chapter, we describe a model for analyzing organizational learning in terrorist groups and suggest ways in which such a model can support counterterrorism analysis within the law enforcement and intelligence communities. Specifically, we discuss how such a model can contribute to the design of terrorism informatics and data analysis efforts.

175

176

1.

Chapter 9. Trujillo and Jackson

INTRODUCTION

Terrorist groups operate under largely hostile and unstable conditions, in which their ability to adapt to their circumstances is critical not only to their effectiveness but also their very survival.1 Successful adaptation, however, does not occur automatically. Instead, the ability of terrorist groups to adapt successfully is dependent on their ability to learn. 2 When a terrorist group can learn, it can purposefully adapt to improve its effectiveness. A terrorist organization that is adept at learning can alter its behavior to better evade detection, modify its tactics to inflict more damage in its attacks, recruit more aggressively without increasing its risk of infiltration, and even alter its portfolio of operations to realize its strategic agenda. This learning can range from incremental efforts by a group to continuously improve its capabilities, such as the ongoing development of improvised explosive devices (IEDs), to more dramatic efforts to bring about a discontinuous transformation of the group’s capabilities and strategy, such as a shift from simple explosives to biological weapons or a shift from targeting local security forces to targeting civilian populations abroad. The greater a group’s capacity for learning, the more resilient it can be to pressures from law enforcement and intelligence agencies, and the greater the threat it poses to its adversaries. Simply acknowledging that terrorist groups can and do learn, however, does not automatically help law enforcement and intelligence organizations seeking to prevent terrorism. While noting that terrorist groups adapt to their environment and efforts to defeat them can help to explain why counterterrorism activities are not always effective, this acknowledgement alone provides little guidance as to how to anticipate terrorist groups’ adaptations before they happen or how to disrupt these groups’ efforts to improve their survivability or destructive capability. To do this, the process by which these groups learn and change over time must be understood. In this chapter, we introduce a model for analyzing the process of organizational learning in terrorist groups and suggest ways in which such a model can support counterterrorism analysis, including the exploitation of informatics tools and strategies, within the law enforcement and intelligence communities. An understanding of the organizational learning process can contribute to counterterrorism informatics efforts in two complementary ways. First, an appreciation of how groups learn can help ensure that information collection and analysis systems capture this facet of terrorist behavior and therefore contribute most effectively to efforts to combat terrorism. Conversely, terrorism informatics may also have much to contribute to efforts to understand how these groups learn and adapt. Building a detailed understanding of groups’ learning efforts can require the

9. Identifying and Exploiting Group Learning Patterns

177

integration and analysis of a variety of data, potentially drawn from many independent sources. Appropriate information and simulation systems could potentially play critical roles in the process of bringing together that data, developing and validating models of group learning efforts, and contributing more broadly to the understanding of how these organizations learn and adapt over time. In the remainder of the paper, we introduce the theory of organizational learning and a variety of concepts to describe different facets of groups learning efforts. As part of this discussion, we include a model of organizational learning as a four-stage process, which we have used in our past work to examine groups’ learning activities. In the second section, we discuss how organizational learning models and theory can inform the design of terrorism informatics systems intended to contribute to efforts to combat terrorism.

2.

ORGANIZATIONAL LEARNING

Before introducing a model for the analysis of organizational learning in terrorist groups, it is important to be clear on what is meant by organizational learning. We define organizational learning as the process through which the members of a group develop new knowledge about their activities and the outcomes they are generating, share it among group members, incorporate the new knowledge into the routines of the group, and preserve this knowledge in collective memory. 3 Defined in this manner, organizational learning is a function of the learning activities of a group’s members, but it is more than the sum of the individual learning of those members.4 The unique attributes of organizational as opposed to individual learning provide groups with critical advantages in their generation and exploitation of knowledge. One of the most important of these advantages is that an organization is not capable of learning completely independently from all individual learning, but an organization can learn independently from any one particular individual. This resiliency advantage is complemented by a production advantage, in that organizations have been identified as also being more effective than individuals at continually building new knowledge or absorbing it from external sources. Organizational learning, unlike that of individuals, can both persist in the absence of any one person and grow more rapidly and broadly than that of any single group member alone. However, the potential of organizational learning should also not be overstated. At the most basic level it is important not to overlook the critical role of individuals to an organization’s learning process by either

178

Chapter 9. Trujillo and Jackson

anthropomorphizing organizations or analyzing organizations as a unified, rather than collective and fragmented, entity. As Garratt (1987) and others have pointed out, in reality a relatively small number of a group’s members usually have the most significant control or influence over the strategic decisions and direction of an organization. Because of the relative influence of such individuals within in an organization, what and how they learn may provide significant insight as to how their organization will learn and adapt to the environment. In this respect, the organization is viewed as a system that shapes and maintains the results of individuals learning efforts, but is still also dependent upon the learning of individuals. Organizational learning of terrorist groups, thus, is both an important and complex process. And, as such, if we are to incorporate the assessment of organizational learning into counterterrorism analysis efforts, we need a model that can help us understand how terrorist groups learn and what factors affect this learning.

3.

A FOUR STAGE MODEL OF ORGANIZATIONAL LEARNING

A number of models of how organizations learn have been described in the literature, each seeking to break down the general concept of “learning” into specific sub-processes that are more analytically useful. In our work, we have used a model of organizational learning as a four-stage information process. We consider this model to be particularly appropriate for counterterrorism analysis because it breaks down organizational learning into four distinct stages – acquisition, distribution, interpretation and storage – which can make the analysis both more tractable. 5 The following sections describe each of the four components of the learning process.

3.1

Acquisition

The acquisition of information occurs in four ways, which we refer to as congenital or inherited knowledge, direct experience, vicarious experience and strategic learning actions. Inherited knowledge is the knowledge that the founding members, and especially leaders, bring to the group. The capabilities that were available to many Islamic fundamentalist groups by their individual members’ prior experience in the Afghanistan resistance against the Soviets is one example of inherited knowledge; similar concerns have been cited about the potential knowledge individuals with experience in Iraq could bring to future terrorist groups and activities. Another is the experience that the original members of the Provisional Irish Republican

9. Identifying and Exploiting Group Learning Patterns

179

Army brought the group from their earlier experiences as part of the Republican movement. Inherited knowledge is most critical to newer terrorist groups and will decline in importance as the organization matures and acquires additional knowledge required for its survival and effectiveness. Direct experience can be acquired in two ways – through experiments or through “learning-by-doing.” While some terrorist groups might engage in intentional experiments to develop new knowledge, it is more likely that new knowledge is acquired unintentionally and unsystematically as groups carry out their activities. The challenge of learning-by-doing, not surprisingly, is thus the further processing of this new knowledge in a systematic fashion, as discussed below. In terms of intentional direct experience, experiments or other “learning actions” can take various forms, ranging from regularly executed activities aimed at uncovering new opportunities, such as uncovering new weaknesses in security systems, to more complex and unproven demonstration projects designed to test new ideas. A range of terrorist organizations have carried out such experimentation and innovation efforts in their development and improvement of explosives devices and other weapons systems. Groups also capture by watching what other similar groups are doing, which we refer to as vicarious experience. While such observation might appear to be an obvious and even simple route to acquire new information, it can be difficult for groups to truly benefit from what they see. Terrorists can gain insight from other terrorist groups’ activities either by actively monitoring other groups or passively becoming aware of other groups’ activities through public reports. At the same time, however, terrorist groups, like other organizations, will frequently not be able to simply translate the insights they gain into actionable knowledge without some, potentially significant, effort. Problems in applying new knowledge frequently come from the different between explicit knowledge, which is knowledge captured in writing or in a physical object like a piece of technology that can be easily transferred to a group, and tacit knowledge, the expertise needed to use the explicit knowledge effectively. Simply put, the knowledge involved in much terrorist activity can be characterized as explicit knowledge. Examples of the acquisition of explicit knowledge include the acquisition of basic tactical concepts by groups that they could employ explosives strapped to persons or airplanes as missiles from sources such as manuals or Internet knowledge sources, or even the actual acquisition of new weapons. However, the actual execution of new activities or the use of novel weapons will depend heavily upon tacit knowledge of how to utilize this explicit knowledge effectively. Tacit knowledge includes the expertise needed to use technologies or

180

Chapter 9. Trujillo and Jackson

execute tactics well, elements frequently not transferred to the group when they acquire new explicit knowledge or technology. In reality, although explicit knowledge can be more readily obtained vicariously, it is often necessary for groups to actually develop the tacit knowledge needed to exploit their vicarious experience on their own through direct experience or experimentation. Finally, because of the need for terrorist groups to protect themselves from detection or infiltration, it is likely that they would be particularly resistant to importing tacit knowledge, which could require the introduction of foreign elements into their organizations, and would thus depend even more so intentional experimentation/training or learning-bydoing to develop this know-how. 6 Nevertheless, if an organization is able to learn vicariously, it would not be limited to learning from other terrorist groups, but could also learn from organized crime, transnational businesses, or even counterterrorism agencies themselves. Examples of groups that have learned by observing counterterrorism operations, include the Provisional Irish Republican Army, Hezbollah in Lebanon, or the Tamil Tigers in Sri Lanka.7 Finally, terrorist groups can also acquire information by engaging in strategic learning actions, which include internal research and development, technology acquisition, and seeking to transfer knowledge from other entities. One of the most noteworthy examples of independent research and development by a terrorist group is Aum Shinryko’s work on the development of biological and chemical weapons.8 A similarly noteworthy example of inter-group cooperation is the reported training of members of the Revolutionary Armed Forces of Colombia (FARC) by the Provisional Irish Republican Army (PIRA).9

3.2

Distribution

While the acquisition of new information is an obvious necessary step in the organizational learning process, once new information is obtained it must also be distributed, interpreted and stored for organizational learning to occur. Distribution advances the learning process in that the more widely information can be distributed within an organization the more likely it is that it will be interpreted and exploited effectively. Distribution is also important for the storage of information, since the possession of knowledge by many group members reduces the chance the organizations’ capabilities will deteriorate over time as members leave or are lost. Finally, the more broadly information can be distributed within an organization the more likely it is that the information will be available for use when it is needed.

9. Identifying and Exploiting Group Learning Patterns

181

Terrorist groups utilize a variety of distribution modes to disseminate information among their members, from training activities that impart knowledge first-hand, to documents that are either written and passed on by hand or published electronically and distributed and stored, openly or hidden, on the internet. In spite of the various alternatives, training activities, such as Islamic groups’ use of camps in Afghanistan for many years, continue to be an especially critical means of distributing knowledge, both operational and strategic, to group members who can then disperse throughout a group’s area of operations.

3.3

Interpretation

Interpretation is the assessment of information in the context of an organization’s goals, capabilities and environment. Without interpretation, the information an organization collects cannot be meaningfully exploited to further the groups’ goals. Factors that influence a group’s ability to effectively interpret information include: how widely the information is distributed within the group,; the capabilities of and richness of the group’s internal communication modes; and the extent to which different members of groups share common frames of reference to assess the information In its fullest sense, interpretation encompasses the values and criteria a group uses to judge the effectiveness of its current operations, the methods by which the group assesses how its environment or needs may be changing and how it might need to change in response, and the process that the group employs to decide whether to pursue new opportunities or activities. Time can also be a critical factor in the interpretation process. In a highpressure environment, a group must make judgments about new information and how to respond quickly enough to be effective. A group that makes the right decision, but does so too late, may damage rather than advance its interests. For example, terrorist groups’ requirement to safeguard their knowledge from organizations seeking to combat terrorism is an important constraint on their abilities to distribute and thus interpret new information. If groups cannot maintain their security without bottlenecking critical information, their ability to learn will be degraded. 10 Finally, beyond assessing new information and translating this information into new behaviors, a key element of groups’ interpretation efforts is unlearning, or the discarding of ineffective or outmoded organizational dynamics. 11 Such unlearning can be especially important to terrorist groups as their evasion of counterterrorism and law enforcement activities, which are frequently based on the recognition of patterns in a group’s past activities, is dependent on their ability to discard those modes of operation that have already been identified.

182

3.4

Chapter 9. Trujillo and Jackson

Storage

The fourth component of the organizational learning process is the storage of information so that the group can effectively access this information again in the future, either to use it as already interpreted or to be reinterpreted in light of newly added information. Most often, learning is captured almost exclusively in the memories of individual members of group, and as a result is largely a function of the distribution of the information. Not surprisingly, this is a rather limited approach to maintaining information and is potentially fragile and subject to deterioration – particularly for terrorist groups where the loss of members is a not unexpected, and occasionally inevitable, outcome of their activities (Carley, 1992; and Kim, 1993). Not surprisingly, this is the mode of storage most used by newly established groups. Significant amounts of information are stored by terrorist groups in this manner through in-person training. Beyond a reliance on its individual members, an organization can store its information in the fabric of the organization, including in the language employed by its members, in routine group activities or rituals, in group symbols and other forms of group culture, and even in the structure of the organization itself. Of course, information can also be stored in written manuals or in other physical media, such as in computers, on the Internet, or in physical storage repositories. As demonstrated by the range of terrorist training materials that have been captured by intelligence organizations or posted on the Internet websites demonstrate, these groups have often chosen combinations of these approaches to store information in written and readily transferable resources.

4.

PATHS OF ORGANIZATIONAL LEARNING

Not all organizational learning is of the same significance to terrorist groups. These groups, like others, can experience both incremental learning and transformational learning, with very different consequences. 12 Incremental learning is the changing of repetitive routines, such as the tracking and correction of errors in specific activities, within the existing boundaries, rules, and norms of the group. In other words, incremental learning is what groups experience as they learn to carry out even more effectively those activities in which they already engaged. Incremental learning generally focus on process improvement: a good example of such a process is the improvement of the Provisional Irish Republican Army of its explosive initiation devices in response to deployment of countermeasures

9. Identifying and Exploiting Group Learning Patterns

183

by the British military or, in a more recent example, in the Iraqi insurgents’ improvisation of new explosive devices and roadblock strategies. 13 In comparison, transformational learning involves the innovation of entirely new processes, objectives or organizational structures that can usually be recognized in more dramatic departure from a group’s current activities. As examples, terrorist groups experience transformational learning when they redefine their strategic goals, abandon a regularly employed tactic, or adopt an entirely new mode of attack. While transformational learning can result from adaptations to remedy errors in specific activities, the source of most incremental learning, transformational learning entails the philosophical and/or strategic re-evaluation of the of the group’s raison d’etre rather than simply its tactical or operational activities. The focus of transformational learning is not to do a previously identified activity more effectively, but to reconsider which activities to engage in and why, with an appreciation of the effects of any change on the long-term mission of the group. As such, transformational change occurs in most cases when a group experiences significant shifts in its environment that threaten its survival or present a unique opportunity for a dramatic step forward towards the realization of its overall organizational goal. Both Al Qaeda’s choices in designing its organization as an international network of loosely coupled cells and its use of airplanes as bombs are examples of transformational learning (Arquilla and Ronfeldt, 2001). Importantly, the distinction between incremental and transformational learning should not be interpreted as absolute, as incremental learning over time can result in the transformational adaptation of a group.14

5.

DETERMINANTS OF ORGANIZATIONAL LEARNING

Even though all groups learn to some extent, the ability to do so can differ considerably from group to group. Researchers have identified a wide variety of organizational characteristics that influence a group’s ability to learn effectively.15 We focus on four groups of factors that are key influences in a group’s capacity to learn – group structure, culture, resources, and environment.

5.1

Structure

The structure of authority and communication within an organization can be a major shaping force of its learning ability. We focus on two aspects of structure that we consider to be particularly strong influences on a group’s

184

Chapter 9. Trujillo and Jackson

learning capacity – (1) the extent of hierarchy or centralization of organizational command and control processes, and (2) the robustness of organizational communications systems. First, a range of studies have identified learning problems associated with hierarchical organizational structures since information can be lost as it is transmitted from level to level within the group.16 This implies that less structured terrorist operations might be more capable of effective learning. On the other hand, this passing of information through a hierarchy can serve as an institutional mechanism for the redundant storage of information, which makes the more structured organization more resilient to deterioration of accumulated knowledge. Similarly, because of their formally defined communications paths, more hierarchically structured or centralized organizations can be less susceptible to information distribution failures. Of course, organizations do not have to be either fully centralized or decentralized, and as such groups can blend strengths and weaknesses of these different structures depending on where they position themselves along the spectrum of network organizational types. 17 The most well-known example of this phenomenon is al Qaeda, which has seemingly been able to benefit from both forms of organizational structure, in accumulating and diffusing knowledge while also promoting rapid experimentation by local cells. While there is some benefit that can be gained from blending these different organizational structures, these so-called hybrid organizations can also be more difficult to control. The communications structure within an organization can also facilitate or impede the group’s ability to learn and adapt. In this context, communications should be understood broadly, including training of group members, manuals circulated in the group that codify organizational values and practices, operating routines and tactics that are shared informally among group members, and formal and informal meetings of members, in addition to the actual technical infrastructure set-up for group communications (i.e. fixed and mobile telephony, radios, Internet systems). The more robust a group’s communications systems, the more capable the organization can be in carrying out the four phases of group learning.

5.2

Culture

Because organizational culture is difficult to define, studies of its effect of the learning capacity of groups have focused on specific group dynamics that can influence learning. We focus first on two of these factors – (1) the organizational interest in learning, and (2) the organizational tolerance for risk-taking. Organizational interest in learning, is driven primarily by the group’s leadership and the emphasis it places on seeking out new capabilities

9. Identifying and Exploiting Group Learning Patterns

185

and opportunities, including undertaking intentional efforts to acquire and distribute new knowledge. An organization’s tolerance for risk, characterized by the prevailing attitude of a group’s membership toward experimenting with new and even unproven practices, is also influence significantly by group leadership. The more willing a group and particularly its leaders are to taking risks, the greater the chance the organization will be to both purse new opportunities (which involve the risk of failure and other potentially negative consequences) and to avoid emerging threats to the group. For example, a terrorist organization that won’t try new things – transition from placed bombs to mortars, for example – would lose its ability to carry out attacks if security measures were put in place to defend against its preferred attack mode. In comparison, if a group were willing to experiment, even though this might result in a number of less than successful operations as its members gained proficiency with a new weapon, might eventually overcome the new hardening measures and continue to pose a meaningful threat against the target. Organizations also suffer from “learning disturbances” – elements of an organization’s culture that get in the way of learning, such as role constraints, situational and fragmented learning, and opportunistic learning. Role constraints arise from rigid organizational assignments that limit the individual group members’ ability to acquire, distribute, interpret or store information. In cases of situational and fragmented learning, new knowledge gained by individual members is not distributed or stored in such a way that it can be readily accessed and exploited by the full membership that could benefit from it to enhance the capabilities of the organization. Finally, opportunistic learning occurs when there are appropriate mechanisms in place for storing and distributing organizational knowledge, but a group’s culture may motivate members not to use them. In such cases, individuals intentionally bypass organizational learning processes that they perceive as inadequate or not in their individual interests, which prevents the organization from learning along with the individual.

5.3

Resources

Third, the learning potential of organizations depends on what we call knowledge resources – its access to external sources of information and the absorptive capacity embodied in its members. First, the greater the degree to which an organization is connected to similar organizations and other sources of information relevant to its environment and operations, the higher the learning potential of the group. Second, an organization’s absorptive capacity, or the degree to which it is capable of acquiring and interpreting new information, is related to the skills and especially the subject-area or

186

Chapter 9. Trujillo and Jackson

technology-specific expertise of its members. As such, groups that already possess similar or complementary tacit or explicit knowledge to that which they are obtaining anew can more readily absorb and exploit this new information. Any terrorist group that thus lacks an adequate level of absorptive capacity will be limited in its capacity to learn, regardless of its raw rate of information acquisition, distribution or storage.

5.4

Environment

Finally, an organization’s environment will also shape its learning ability. Changes in groups’ environment can provide incentives for learning or even force groups to experiment in ways they might not otherwise. A number of researchers have identified the level of uncertainty and the rate of change in an organization’s environment as factors that can provide both incentives and disincentives for learning (Dodgson, 1993; and Garvin, 1993). For example, Bron Taylor links the founding of Earth First!, whose members splintered from other less violent elements of the environmental movement, with the significant changes that were made in environmental policies during the Reagan Administration, and the Earth Liberation Front’s initiation of major fire bombings with shifts in federal logging policy.18 More general environmental factors can also directly affect a groups’ learning capability. Some environmental characteristics – such as the proximity of knowledge sources or a particularly permissive security environment – can facilitate learning for groups that attempt it by making it easier to access needed resources and providing the freedom of action needed to experiment with and explore new operational concepts or technologies. These factors are key reasons why terrorist access to safe havens – areas or nations where they are insulated from counterterrorist pressures – are worrisome from an innovation perspective. Although strong security pressure can provide a potent incentive for learning – as described previously – it can also make learning more difficult by depriving groups of the access to resources and liberty to learn.

6.

HOW AN ORGANIZATIONAL LEARNING MODEL CAN INFORM THE DESIGN OF TERRORISM INFORMATICS SYSTEMS

Although it is important to recognize that terrorist groups learn, simply noting that such adaptation is occurring does not provide sufficient guidance or insight to meaningfully improve counterterrorism analysis. Greater detail and specificity is needed to make such awareness actionable – that is,

9. Identifying and Exploiting Group Learning Patterns

187

counterterrorist analysts need to understand not just that terrorist groups learn but how they learn in order to appropriately monitor and assess their learning activities and outcomes. The model of terrorist learning described above moves toward that needed understanding: by breaking down the composite and complex process of “learning” into discrete pieces, the information process model helps frame specific and actionable questions about how individual terrorist groups learn. Such actionable questions – questions of sufficient specificity that they suggest both the data necessary to answer them and how that data might be collected – can similarly help to link information systems and informatics tools to efforts to detect and understand terrorist group behavior. For the purposes of highlighting how a model of organizational learning can inform the design of terrorism informatics, we will examine the utility of the model in ensuring the right intelligence is collected to understand terrorist efforts to innovate, how those data are filtered, and that the data can be properly interpreted. 19

6.1

Collecting the Right Information

For an intelligence analyst to be able to detect and understand terrorist learning efforts, the right information must be available. Because successful organizational learning requires a terrorist group to carry out all four of the component processes described previously (acquisition, distribution, interpretation and storage), information regarding a group’s progress along all four dimensions is necessary to piece together a complete picture of the group’s learning. In the absence of information on any of the steps – if there are “blind spots” where intelligence data are not available – the analyst cannot be expected to understand what a group is doing or the likely consequences of its learning activities. By providing a clear delineation of what information must be collected to have a complete picture of a terrorists’ group learning, the model that we have described can help to ensure that blind spots do not go unnoticed and can instead be filled. As such, a model of organizational learning can help to guide the design of information systems and the collection of data to populate them and, once gathered, ensure that it is managed in a way that ensures it will be available and appropriately evaluated to increase understanding of how groups are changing over time.

6.2

Filtering Collected Data

Because of the nature of intelligence collection, much more data is invariably collected than can be analyzed effectively. In a deep stream of incoming intelligence, there is always therefore the risk that key pieces of

188

Chapter 9. Trujillo and Jackson

information will slip by unnoticed. Pieces of data that are clearly important are not likely to be overlooked. As a result, large transformational changes in a group are generally obvious – its operations have changed direction in major ways or it has adopted entirely new weapons and tactics than it did so before. Such shifts are likely to be noticed and will therefore be pulled out of the intelligence stream for additional attention. More subtle changes, such as those associated with incremental learning may be less obvious, however, as the immediate outputs of incremental change will generally be harder to recognize and the larger effects of incremental change emerge over time. In their incremental learning, terrorist groups may also exploit different acquisition, interpretation, distribution, and storage practices than when pursuing more transformative learning. As discussed previously, ignoring the succession of incremental changes over time could set the stage for not being able to detect any subsequent transformative shift in capabilities or strategies. In order to make use of the massive amounts of intelligence that can be collected each day, analysts must rely on analytical frameworks to contextualize this information and make judgments about the relative importance of individual pieces of data.20 In the absence of analytical frameworks describing group learning, relevant data indicating that a group is attempting to innovate or change its operational practices may not be identified as important and could therefore slip by unnoticed. By dissecting group learning processes in more detail and defining a broader range of processes and characteristics relevant to adaptive behaviors, models of group learning can provide an analytical framework to help ensure relevant intelligence is detected and examined. Such frameworks could be built into informatics systems to help the analyst continually scan and analyze data on various critical indicators of organizational learning, shifts in which could suggest that a group is attempting to or has been able to enhance their capabilities or shift targets. These type of automated filters or analysis tools could potentially be used to cue analysts attention to data relevant to understanding learning activities – provided appropriate cues can be devised that can help to identify potentially useful data out of the background of other data. Some such cues could be based on the outputs of learning – use of new tactics, significant changes in apparent group skill or performance, etc. but, such filters only suggest to the analyst that learning has occurred, not how or why. Models that drill inside the process could help develop tools that can cue attention toward less obvious data and apparent group activities to lead the analyst to recognize the learning process before it is complete and its effects realized.

9. Identifying and Exploiting Group Learning Patterns

6.3

189

Analyzing Intelligence Data

The analysis of intelligence data relating to learning can be seen as attempting to achieve two goals: (1) detect group learning efforts before they are complete and (2) once detected, anticipate whether or not the group will be successful in its attempt to learn. Models of group learning can contribute to achieving both goals – and to the design of informatics systems to help analysts do so. Frameworks to Help Detect Group Learning. The process of intelligence analysis is one of ascertaining meaning from fragmentary, deceptive, and otherwise imperfect data. Just as analytical frameworks help to identify what pieces of data are important and merit attention, similar frameworks or “analytical lenses” help to make sense of individual pieces of information in light of what is otherwise known about the group. That is, they help to determine what a newly detected piece of information means in light of current understandings of the group’s strategy, the behavior of its leadership, its internal dynamics, and so on. 21 The assumed meaning ascribed to a group recruiting members in a new geographical area can be heavily dependent on framework. In a framework focused on the group’s strategic goals, such an act might be interpreted as an expansion of violent activities into the new country. In a framework assessing behavior with respect to the psychology and internal dynamics of an organization, the same act might be interpreted as reflecting the group’s need to appear dynamic to support the morale of its current membership. Without an analytical framework that captures a terrorist group’s learning activities, an analyst may not be able to appreciate the learning implications of the group’s actions. From a learning perspective, such activity might indicate that the group is gathering information or knowledge for the purpose of expanding its capabilities. Similarly, specific attacks that do not make sense from a strategic perspective may be perfectly reasonable from a learning perspective. For example, if a terrorist group attacks a target that seems to have low priority or is outside its usual areas of operation, an analysis focused on strategy might conclude that the group has been forced away from its favored targets or has shifted its goals. But from a learning perspective, such an attack could be seen quite differently, perhaps as an important “dress rehearsal” to help the group learn what it needs to do to carry out a higher-profile operation in the future. Similarly, individual operations that appear detrimental to a terrorist group’s interests from a strategic or psychological perspective may have very different implications when viewed from the perspective of the group’s learning goals.

190

Chapter 9. Trujillo and Jackson

While analytic lenses and frameworks will be always applied “manually” by analysts as part of their interaction and examination of intelligence data, appropriately designed informatics tools and expert systems could play a part in doing so as well. Informatics tools, incorporating models of group learning, could help analysts examine group activities through all such lenses – helping to suggest hypotheses about the meaning of different group activities to ensure that activities are not misinterpreted and their importance overlooked. Tools to Help Anticipate Whether Terrorist Learning Efforts Will Be Successful. Even after they have been identified, the analyst must assess whether or not the effort will be successful. Even if a terrorist organization wants to do something new, if it cannot do it successfully its desire to do so poses little or no threat. Trying to anticipate whether or not a group will be successful in its learning efforts is a problem of projection – based on what we know about the group and its past learning efforts, what are the chances that it will succeed at what it is trying to do now? Even if it will succeed, will it be easy or hard? How much will doing so cost the group in time, money, or other resources that have to be devoted to the learning effort? Because learning is the link between a group’s intentions and its ability to bring together the information and resources to actually realize these intentions, understanding how terrorist groups learn can directly contribute to anticipating whether their learning actions will be successful and, accordingly, to determine the level of threat they pose. Because of the range of characteristics that have been identified as relevant to assessing learning performance, informatics tools could provide critical support to intelligence analysts in making these assessments. Data and analytical systems that tabulate available data on groups in relevant ways are a simple example. At a more sophisticated level, given the complexities of group learning processes and the heterogeneity among groups that make it difficult to draw unambiguous conclusions about learning ability, systems that enable comparison of different models, theories, data, and analytical approaches could be very important for assessing the sensitivity of conclusions to particular assumptions – and the potential consequences if those assumptions turn out to be wrong.

7.

CONCLUSIONS AND DISCUSSION

Understanding and detecting terrorist group learning and adaptation is largely a question of data – collecting the right information, identifying the right pieces of data for subsequent attention, and interpreting the data to

9. Identifying and Exploiting Group Learning Patterns

191

provide insight as to its implications for about terrorist motivations and capabilities. Success in this process means the intelligence analyst can deny the terrorist the advantage of surprise and may gain the opportunity to disrupt the group’s future plans. Failure by a security organization means success for the terrorist, and the need for security organizations once again to respond and “catch up” to the new security environment. Informatics systems can play an important role in this ongoing competition. Unambiguous and easy indicators of terrorist groups’ learning – new weapons used, new skills applied, new strategic targets hit – are readily available to counterterrorism analysts only after the terrorists’ learning efforts are complete and most opportunities for prevention or disruption are already past. Detecting learning earlier requires bringing together data from disparate sources and seeking out clues to learning efforts still underway – indicators of terrorists’’ information gathering, assessments of their current operations or future opportunities, their distribution of information, and their ability to store and recall lessons from their experiences. Though much more difficult, if law enforcement and intelligence agents can develop and employ well-crafted informatics tools to detect such signatures, a much broader range of options for prevention and disruption could be available and could meaningfully increase the capacity of security organizations for defending against the terrorist threat.

8.

ACKNOWLEDGEMENTS

This chapter draws on research supported in part by Grant No. 2003-IJCX-1022, awarded by the National Institute of Justice, Office of Justice Programs, U.S. Department of Justice. Points of view in this document are those of the authors and do not necessarily represent the official position or policies of the RAND Corporation or the U.S. Department of Justice. Portions of this chapter draw on the project reports of that study, whose full bibliographic information is cited in the suggested readings at the conclusion of the chapter. We would like to thank the many individuals at RAND, the National Institute of Justice and elsewhere who contributed to and supported the original RAND study on organizational learning in terrorist groups. In particular, we would like to acknowledge and express our gratitude to John C. Baker, Kim Cragin, John Parachini and Peter Chalk, our colleagues and coauthors of our original study. Finally, we would like to thank our colleagues Barbara Raymond and Mike Wermuth for their helpful suggestions for improving the manuscript.

192

Chapter 9. Trujillo and Jackson

NOTES 1

For detailed discussions of the adaptability of terrorist groups, see K. Cragin and S. Daly, The Dynamic Terrorist Threat: An Assessment of Group Motivations and Capabilities in a Changing World, Santa Monica: RAND, 2004; M. Crenshaw, “Innovation: Decision Points in the Trajectory of Terrorism,” presented at the Conference on Trajectories of Terrorist Violence in Europe, Minda de Gunzburg Center for European Studies, Harvard University, Cambridge, MA, March 9–11, 2001; S. Gerwehr and R. Glenn, Unweaving the Web: Deception and Adaptation in Future Urban Operations, Santa Monica: RAND, 2003. pp. 49-53; “Change and Continuity in Terrorism,” Studies in Conflict and Terrorism, Vol. 24, 2001, pp. 417–428.; B. Jackson, et al, Aptitude for Destruction, Volumes 1 and 2, Santa Monica: RAND, 2005; J. Kitfield, “Osama’s Learning Curve,” National Journal, Vol. 33, No. 45, 2001, pp. 3506–3511; C. Lutes,, "Al-Qaida in Action and Learning: A Systems Approach," December 2001, http://www.au.af.mil/ au/awc/awcgate/ readings/ al_qaida2.htm; Stern, Jessica, “The Protean Enemy,” Foreign Affairs, Vol. 82, No. 4, 2003, pp. 27–40; and Thomas, Troy S., and William D. Casebeer, Violent Systems: Defeating Terrorists, Insurgents, and Other Non-State Adversaries, Colorado Springs, CO: United States Air Force Academy, United States Air Force Institute for National Security Studies, 2004, pp. 35–38. 2 While change in the way a group carries out its activities is frequently indicative of learning, change alone is not sufficient to indicate that organizational learning has occurred. All change is not necessarily intentional; some change can be unintentional or be a byproduct of other group behavior. As such, in this discussion, we consider learning to be the sustained change of organizational behavior that arises from intentional action by or within a group, such as one or more of the following: the intentional search for new knowledge or skills; intentional evaluation of group behaviors, new or old, that leads to efforts to retain valuable behaviors and discard others; and intentional dissemination of valued knowledge within a group or among groups. 3 This definition is a composite of others that can be found in the organizational learning literature. Ours draws in particular from that of Barnett (C. Barnett, n.d., “Rethinking organizational learning theories: A review and synthesis of the primary literature,” Unpublished manuscript, University of New Hampshire, Whittemore School of Business and Economics) cited by Lipshitz et al (2002) which defines organizational learning as: “an experience-based process through which knowledge about action-outcome relationships develops, is encoded in routines, is embedded in organizational memory and changes collective behavior” (p.82). 4 Two brief citations from the literature on organizational learning distill the argument of recognizing organizational learning as distinct from individual learning. The first, from Romme and Dillen (1997), emphasizes the nature of organizational learning as focusing on the change of shared beliefs and collective behaviors of members of a group: “Organizations do not have brains but do have cognitive systems and memories at their disposal, through which certain modes of behavior, mental models, norms and values are retained.” The second, from Easterby-Smith et al (2000), emphasizes the supra-individual character of organizational learning: “Members [of an organization] come and go, and leadership changes, but organizations’ memories preserve certain behaviors, mental maps, norms and values over time.” 5 Romme and Dillen (1997) present a brief but detailed treatment of organizational learning as an information process from which some of this material has been adapted. 6 See K.K. Jones “Competing to learn in Japan,” McKinsey Quarterly 1, 1991 pp.45-57.

9. Identifying and Exploiting Group Learning Patterns 7

193

See discussion in B.A. Jackson, et al, Aptitude for Destruction, Volume 2: Case Studies of Organizational Learning in Five Terrorist Groups, Santa Monica, CA: RAND Corporation, 2005 8 J. Parachini, “Aum Shinrikyo,” in Aptitude for Destruction, Volume 2: Case Studies of Organizational Learning in Five Terrorist Groups, Santa Monica: RAND Corporation, 2005. 9 A. Ward, “The IRA’s Foreign Links,” IISS Strategic Comments 9:5, July, 2003 10 See R.L. Daft and R.H. Lengal, “Organizational Information Requirements: Media richness and structural design,” Management Science 32, pp. 554-571, 1986. 11 It should be noted that some researchers use the term unlearning to refer to the maladaptation of organizations that results in unwanted or less effective outcomes (see Crossan et al, 1995). We have chosen not to adopt this convention since it is our belief that defining learning as a positive process, and unlearning as simply a mode of learning, simplifies the analysis. From the perspective adopted in this paper, maladaptive learning, rather than unlearning, would be the result of a group attempting to learn but doing it very poorly. 12 We utilize incremental and transformational learning as roughly equivalent to “single-loop” and “double-loop” learning as discussed in the academic literature on organizational learning. We believe that the distinction originally drawn by Argyris and Schön (1978) is a valuable one, which we borrow from. 13 See Hoffman, B. “Terrorism Trends and Prospects,” in Countering the New Terrorism, I.O. Lesser et al, Santa Monica:RAND,1999, pp.7-38, on the IRA,, and Scarborough, R., “Iraqi guerrillas devise new tactics as Americans fine tune techniques” The Washington Times, 31 July 2003, on the Iraqi insurgents. 14 Both Argyris and Schön (1978) and Senge (1990) note that most organizations do reasonably well with incremental learning but not with transformational learning. 15 See, B. Jackson et al., Aptitude for Destruction, Volumes 1 and 2 (2005), and references therein, for a more complete discussion on the determinants on organizational learning in terrorist groups. 16 See D.M. Schweiger,, T. Atamar and R. Calori, “Transnational project teams and networks: making the multinational organization more effective,” Journal of World Business 38, pp.127-140, 2003 17 For a review of network forms of organization, including a discussion of the classification of more structured hierarchies and more loosely organized groups as forms of networks, see J. Podolny and K. Page, “Network Forms of Organization.” Annual Review of Sociology, 24, pp.57-76, 1998. See also, B.A. Jackson, “Groups, Networks or Movements,” Studies in Conflict and Terrorism, 29:3, April-May 2006, pp.241-262, for a discussion of command and control linkages in groups as distinct from the group structure defined by those linkages 18 B. Taylor, “Religion, Violence and Radical Environmentalism: From Earth First! to the Unabomber to the Earth Liberation Front,” Terrorism and Political Violence, 10/4, pp. 142, 1998. Also, for a discussion of organizational in the radical environmentalist movement, see H. Trujillo “The Radical Environmentalist Movement,” in Aptitude for Destruction, Volume 2: Case Studies of Organizational Learning in Five Terrorist Groups, Santa Monica: RAND Corporation, 2005, pp. 141-172. 19 For readers interested in a comprehensive discussion of applications of organizational learning in efforts to combat terrorism, see Jackson et al, 2006a. 20 See M. Libicki and S. Pfleeger, Collecting the Dots, Santa Monica: RAND, January 2004

194 21

Chapter 9. Trujillo and Jackson

See, for example, McCormick, Gordon H., "Terrorist Decision Making," Annual Review of Political Science, Vol. 6, 2003, pp. 473-507.

REFERENCES Argyris, C. and D. Schön, Organizational Learning: A Theory of Action Perspective, Reading: Addison-Wesley, 1978. Argyris, C. and D. Schön, Organizational Learning II: Theory, Method and Practice, Reading: Addison-Wesley, 1996. Carley, K. “Organizational Learning and Personnel Turnover,” Organization Science 3, pp. 20-46, 1992. Crossan, M.M., Lane, H.W., White, R.E. and Djurfeldt, L. (1995), “Organizational learning: dimensions for a theory”, The International Journal of Organizational Analysis, Vol. 3, No. 4, (October), pp.337-360. Cyert, R.M. and J. G. March, A Behavioral Theory of the Firm, Englewood Cliffs: Prentice Hall, 1963. Dodgson, M. “Organizational Learning: A review of some literature,” Organizational Studies 14, 1993, pp. 375-394. Easterby-Smith, M., and M. Crossan and D. Nicolini, “Organizational Learning: Debates Past, Present and Future,” Journal of Management Studies 37:6, September 2000. Fiol, C.M., and M.A. Lyles, Organizational Learning,” Academy of Management Review 10, pp. 803-813, 1985. Garratt, R., The Learning Organization, London: Fontana: Collins, 1987. Garvin, D.A., “Building a Learning Organization,” Harvard Business Review 71, JulyAugust, 1993, pp.78-91. Hedberg, B. “How Organizations Learn and Unlearn” in Handbook of Organizational Design, Volume 1, P.C. Nyström and W.H. Starbuck, editors, Oxford: Oxford University Press, pp. 3-27, 1981. Huber, G.P., Organizational Learning: “The contributing process and the literatures,” Organizational Science 2, pp. 88-115. Kim, D.H., “The link between individual and organizational learning,” Sloan Management Review, Fall 1993, pp. 37-50. Lipshitz, R. M. Popper, and V. Friedman, “A Multifacet Model of Organizational Learning,” The Journal of Applied Behavioral Science, 38:1, March 2002 McGill, M.E., and J.W. Slocum, Jr., “Unlearning the Organization,” Organization Dynamics 22, pp. 67-79, Autumn 1993. March, J.G. and J.P. Olsen, “The uncertainty of the past: Organizational learning under ambiguity,” European Journal of Policy Review 3:2, pp. 147-171, 1975. Miller, D., “A preliminary topology of organizational learning: Synthesizing the literature,” Journal of Management, 22:3, pp. 485-505, Romme, G., and R. Dillen, “Mapping the Landscape of Organizational Learning,” European Management Journal 15:1, 1997. Senge, P. The Fifth Discipline: The art and practice of the learning organization, New York:Doubleday, 1990. Shrivastava, P. “A Typology of Organizational Learning Systems,” Journal of Management Studies 20, pp. 7-28, 1983.

9. Identifying and Exploiting Group Learning Patterns

195

SUGGESTED READINGS · B.A. Jackson, et al, Aptitude for Destruction, Volume 1: Organizational Learning in Terrorist Groups and its Implications for Combating Terrorism, Santa Monica, CA: RAND Corporation, 2005. · B.A. Jackson, et al, Aptitude for Destruction, Volume 2: Case Studies of Organizational Learning in Five Terrorist Groups, Santa Monica, CA: RAND Corporation, 2005. · J. Arquilla and D. Ronfeldt, Networks and Netwars: The Future of Terror, Crime and Militancy, Santa Monica, CA: RAND Corporation, 2001. · M. Libicki, and S. Pfleeger, Collecting the Dots, Santa Monica: RAND, January 2004. · I.O. Lesser et al, Countering the New Terrorism, Santa Monica: RAND, 1999, pp.7-38.

ONLINE RESOURCES · RAND Corporation www.rand.org · National Memorial Institute for the Prevention of Terrorism (MIPT) www.mipt.org · National Institute of Justice www.ojp.usdoj.gov/nij

DISCUSSION QUESTIONS 1. What is the role of models or analytical frameworks in counterterrorism analysis? What value does an appreciation of organizational learning add to counterterrorism analysis and especially terrorism informatics? 2. Structure, culture, resources and environment are introduced as general categories of factors that influence the capacity of an organization to learn. Identify specific examples of how each of these determinants might be considered to have influenced the adaptive behavior of one or more terrorist groups. What lessons do these examples suggest for the design of terrorism informatics systems? 3. In thinking about designing information systems to help detect group learning efforts, what type of information should be collected and input into the system? What indicators or signatures might be valuable to look

196

4.

5. 6.

7.

8.

Chapter 9. Trujillo and Jackson

for in the data? What ways could groups adapt their behaviors to obscure or remove those signatures? The model of organizational learning presented here is considered to apply to all organizations. However, terrorist groups are different from other organizations in important ways. What adjustments in data collection and interpretation do these differences make necessary to properly assess the organizational learning of terrorist groups? How do terrorist organizations’ need to maintain their security affect their ability to learn and adapt? Provide specific examples of the incremental learning and transformational learning of a terrorist group. What characterizes the one type of learning from the other? If one group adapts its behavior in a way that is incremental for that group, does the same adaptation have to be considered incremental for all other groups that make the same change in behavior? How can counterterrorism analysis systems, and especially terrorism informatics systems, be designed to provide appropriate detection and warning of incremental and transformational learning? In recent years, there has been significant focus on violent organizations that have adopted loosely controlled network structures where individual units may not know about the existence of other units and make all their own decisions about the activities their unit undertakes. What are the strengths and weaknesses of this model from a group learning perspective? In the chapter, the example of a group recruiting members in a new area was used to illustrate how a “learning-focused analytical lens” could suggest a different interpretation for a piece of intelligence data. What alternative meanings might be ascribed to the detection of a large explosion in a suspected terrorist safehouse through the different analytical lenses described in the text?

10 HOMELAND INSECURITY Data Mining, Privacy, Disclosure Limitation, and the Hunt for Terrorists Stephen E. Fienberg Department of Statistics, Machine Learning Department, and Cylab, Carnegie Mellon University, Pittsburgh, Pennsylvania, U.S.A. ([email protected])

CHAPTER OVERVIEW Following the events of September 11, 2001, there has been heightened attention in the United States and elsewhere to the use of multiple government and private databases for the identification of possible perpetrators of future attacks, as well as an unprecedented expansion of federal government data mining activities, many involving databases containing personal information. There have also been claims that prospective datamining could be used to find the “signature” of terrorist cells embedded in larger networks. We present an overview of why the public has concerns about such activities and describe some proposals for the search of multiple databases which supposedly do not compromise possible pledges of confidentiality to the individuals whose data are included. We also explore their link to the related literatures on privacy-preserving data mining. In particular, we focus on the matching problem across databases and the concept of “selective revelation” and their confidentiality implications.

197

Chapter 10. Fienberg

198

1.

INTRODUCTION

The events of September 11, 2001 changed our lives in irrevocable ways. They have also changed the focus of US government activities, both at home and abroad. You would have to have been in hibernation for the past five years to miss the fact that the U.S. government is engaged in a hunt for terrorists. While the government has often used data collected for administrative and other purposes as part of security efforts, after 9/11 the effort has intensified and shifted in some surprising ways, raising questions about the appropriate uses of data mining tools, privacy, and the protection of individual information. Where and how does the government look for terrorists? Multiple government organizations are involved in these security efforts, beginning with the National Security Agency (NSA), and including a variety of other agencies such as the Central Intelligence Agency (CIA), Federal Bureau of Investigation (FBI), and those within the Department of Homeland Security (DHS). Clearly there are many sources of information that government officials tap into in this regard. Many believe that if we sift through the data available from a wide array of sources using the latest data mining techniques we’ll find the clues to prevent the next terrorist attack. Some of these people believe that every database and every source of information is fair game—airline and other transportation records, telephone call logs, responses to surveys, credit card purchases, census data, etc.—irrespective of promises of protection, legal and otherwise. If data mining of existing data bases is such a good thing, why are civil libertarian and public watch-dog groups like the American Civil Liberties Union (ACLU) so upset over its use? One of the problems is that many of the databases that are targets for data mining contain personal information that we have long believed was not subject to such data snooping such as our telephone and library records and especially those data back up by legal pledges of confidentiality. Thus there is a public issue as to whether or at least the extent to which we should trade our privacy for the protection against terrorist attacks that data mining might afford us. There’s one further problem: We don’t know what form the next attack will take, but we can look for clues about potential terrorists we have seen in the past. This is why Congress, in its wisdom as part of the USA Patriot Act, rescinded the confidentiality provision for data from the National Center of Educational Statistics (NCES) to allow government access to identifiable individual information. This still might sound strange to you until you realize that NCES data files include information on individuals enrolling in flight schools and we know that several of the 9/11 hijackers spent time at a flight school in Florida prior to their coordinated attack!

10. Homeland Insecurity

199

Moreover, the 20 attackers showed up in a variety of other “unprotected” non-confidential databases once they had been identified. And the price for this kind of “retrodiction” is the potential loss of privacy, especially when we look at the sources of the data the advocates of data mining want to exploit. As the Patriot Act came up for renewal this past summer, some in Congress attempted to force the government to disclose its use of data mining techniques in tracking suspects in terrorism cases, an effort that the Bush administration strongly resisted. Advocates for controls believe the public has the right to know what databases are being searched and with what data mining algorithms. As pernicious as the USA Patriot Act provision rescinding the confidentiality provision of NCES was to many, perhaps the biggest threat to privacy in the hunt for terrorists comes from data warehouse operations that draw on all databases, public and private, confidential and not. Companies such as Acxiom, ChoicePoint and LexisNexis use their data to perform background check on prospective applicants to employers, insurers, and credit providers. The recent security lapses at these and other large organizations, such at Bank of America, have been regular news items over the past couple of years and they point to serious security vulnerabilities. Someone recently observed that the security lapses at these companies confirm the maxim that “a company can have information security without privacy but not privacy without information security.” The data warehouses also participate in the hunt for terrorists. They merge and match data on individuals, impervious to error and inaccuracies, and then repackage the data for sale to other private enterprises and government programs, at both the federal and state level. The ACLU website includes a “flash movie” of a telephone pizza order 1 that triggers a series of data retrievals from some gigantic integrated data base that includes medical records, travel information, magazine subscriptions, clothing purchases, and seemingly instantaneously linked local area crime reports. It represents the public's worst fears regarding the invasion of privacy that has come from e-commerce and growth and spread of data-warehousing. The website warns that “Government programs such as MATRIX and Carnivore are destroying our privacy. We live in a democratic society and governmentcontrolled data systems are a dangerous step toward establishing a 24-hour surveillance society.” What are these programs? Is the pizza movie myth or reality? The remainder of this chapter is organized as follows: In the next section we briefly describe a related set of government data mining and data warehousing activities that came into the public eye following the terrorist attacks of September 11, 2001. One of the links with the more public ecommerce activities was MATRIX, referred to by the ACLU webpage but

200

Chapter 10. Fienberg

which has since been “publicly” abandoned. We then give an overview of record linkage and its use for merging large data files from diverse sources as well as its implications for the splitting of data bases for privacy protection, and following this we review some proposals that have surfaced for the search of multiple data bases without compromising possible pledges of confidentiality to the individuals whose data are included and their link to the related literature on privacy-preserving datamining. In particular, we focus on the concept of selective revelation and its confidentiality implications especially for the types of transaction data bases envisioned for incorporation into TIA. We relate these ideas to the recent statistical literature on disclosure limitation for confidential data bases and explain the problems with the privacy claims and we also discuss the utility of transactional data bases in the discovery of terrorist networks. We conclude with some observations regarding privacy protection, data warehousing, and data mining.

2.

HOMELAND SECURITY AND THE SEARCH FOR TERRORISTS

A recently issued report from the U.S. General Accounting Office (2004) notes that at least 52 agencies are using or are planning to use data mining, “factual data analysis,” or “predictive analytics,” in some 199 different efforts. Of these, at least 29 projects involve analyzing intelligence and detecting terrorist activities, or detecting criminal activities or patterns. Notable among the non-responders to the GAO inquiry were agencies like the CIA and the NSA. Perhaps the most visible of these efforts was the Total Information Awareness (TIA) program initiated by the Defense Advanced Research Program (DARPA) in DARPA’s Information Awareness Office (IAO), which was established in January 2002, in the aftermath of the September 11 terrorist attacks. The TIA research and development program was aimed at integrating information technologies into a prototype to provide tools to better detect, classify, and identify potential foreign terrorists. When it came under public scrutiny in 2003, TIA morphed into the Terrorist Information Program (still TIA) with essentially the same objectives although it too did not move forward into implementation. TIA served as the model, however, for the Multistate Anti-terrorism Information Exchange (MATRIX) system that was in use in seven states for a period of time during 2004 and 2005, and was intended to provide “the capability to store, analyze, and exchange sensitive terrorism-related information in MATRIX data bases among

10. Homeland Insecurity

201

agencies, within a state, among states, and between state and federal agencies.” According to a recent report from the Congressional Research Service (Relyea and Seifert 2005) [footnotes omitted]: The MATRIX project was initially developed in the days following the September 11, 2001, terrorist attacks by Seisint, a Florida-based information products company, in an effort to facilitate collaborative information sharing and factual data analysis. At the outset of the project, MATRIX included a component Seisint called the High Terrorist Factor (HTF), which was designed to identify individuals with high HTF scores, or so-called terrorism quotients, based on an analysis of demographic and behavioral data. Although the HTF scoring system appeared to attract the interest of officials, this feature was reportedly dropped from MATRIX because it relied on intelligence data not normally available to the law enforcement community and because of concerns about privacy abuses. …The analytical core of the MATRIX pilot project is an application called Factual Analysis Criminal Threat Solution (FACTS), described as a “technological, investigative tool allowing query-based searches of available state and public records in the data reference repository.” The FACTS application allows an authorized user to search “dynamically combined records from disparate datasets” based on partial information, and will “assemble” the results. The data reference repository used with FACTS represents the amalgamation of over 3.9 billion public records collected from thousands of sources. The data contained in FACTS include FAA pilot license and aircraft ownership records, property ownership records, information on vessels registered with the Coast Guard, state sexual offender lists, federal terrorist watch lists, corporation filings, Uniform Commercial Code filings, bankruptcy filings, stateissued professional license records, criminal history information, department of corrections information and photo images, driver's license information and photo images, motor vehicle registration information, and information from commercial sources that “are generally available to the public or legally permissible under federal law. …To help address the privacy concerns associated with a centralized data repository, some officials have suggested switching to a distributed approach whereby each state would maintain possession of its data and control access according to its individual laws. The data reference repository is said to exclude data from the following list of sources:

202

Chapter 10. Fienberg

· · · · · · · · · · · ·

telemarketing call lists, direct mail mailing lists, airline reservations or travel records, frequent flyer/hotel stay program membership information or activity, magazine subscription records, information about purchases made at retailers or over the Internet, telephone calling logs or records, credit or debit card numbers, mortgage or car payment information, bank account numbers or balance information, records of birth certificates, marriage licenses, and divorce decrees, utility bill payment information. Nonetheless, MATRIX and its data records sound suspiciously like the ACLU Pizza Movie scenario! And in 2004, LexisNexis acquired Seisint and the security breaches were in the new Seisint subsidiary, the very same one that provides the data for MATRIX! MATRIX was officially abandoned as a multi-state activity in April 2005 although individual states were allowed to continue with their parts of the program. For an assessment of the lack of privacy policies for MATRIX, see Privacy Office (2006). This does not mean the demise of the TIA effort, however, as there are other federal initiatives built on a similar model: Analysis, Dissemination, Visualization, Insight, and Semantic Enhancement (ADVISE), a research and development program within the Department of Homeland Security (DHS), part of its three-year-old “Threat and Vulnerability, Testing and Assessment” portfolio. 2 The Information Awareness Prototype System (IAPS), the core architecture that tied together numerous information extraction, analysis, and dissemination tools developed under TIA, including the privacyprotection technologies, was moved to the Advanced Research and Development Activity (ARDA), housed at NSA headquarters in Fort Meade, Md. 3 In TIA, MATRIX, ADVISE, and IAPS, the idea is for the data miner to issue queries to the multiple linked data bases and receive responses that combine data on individuals across the data bases. The goal is the identification of terrorists or criminals in a way that would not be possible from the individual data bases. We distinguish between two aspects of this goal: (1) identification of known terrorists which is a form of retro- or postdiction, and (2) identification of potential future terrorists and profiling, which involves prediction. Prediction cannot be separated from uncertainty, postdiction might conceivably be. Most of the public outcry regarding TIA

10. Homeland Insecurity

203

and MATRIX has focused on concerns regarding what Clarke (1988) described as “dataveillance” and terrorist profiling, i.e., concerns both about the use of data for purposes other than those for which they were collected without the consent of the individual, and about the quality and accuracy of the mined data and the likelihood that they may help falsely identify individuals as terrorists. In the next two sections, we explore some issues related to the creation and the use of “linked” data bases for the privacy of the individuals whose confidential information in contained in them.

3.

MATCHING AND RECORD LINKAGE METHODS

More than 100 vendors offer record matching systems, some of which sell for thousands of dollars, but most of the underlying methodology for such systems is proprietary and few details are publicly available. Matches can occur at random. For example, consider a pair of files, A and B, containing n records on the same individuals. Then the probability of correctly matching exactly r individuals by picking a random permutation for file B and linking to file A is

( -1) n - r ån = 0 n ! / r! n-r

Domingo-Ferrer and Torra (2003) derive this baseline and illustrate it numerically in an example with n = 90, where the expected number of correct matches is O(1024). Working with actual data in the matching process can change this situation drastically. Bilenko et al. (2003) provide an overview of the published literature on the topic noting that most methods rely on the existence of unique identifiers or use some variation of the algorithm presented in Fellegi and Sunter (1969). Fellegi and Sunter's approach is built on several key components for identifying matching pairs of records across two files: · Represent every pair of records using a vector of features (variables) that describe similarity between individual record fields. Features can be Boolean (for example, last-namematches), discrete (for example, first ncharacters-of-name-agree), or continuous (for example, string-editdistance-between-first-names). · Place feature vectors for record pairs into three classes: matches (M), non-matches (U), and possible matches. These correspond to “equivalent,” “nonequivalent,” and possibly equivalent (e.g., requiring human review) record pairs, respectively.

204

Chapter 10. Fienberg

· Perform record-pair classification by calculating the ratio P(g|M)/(P(g|U) for each candidate record pair, where g is a feature vector for the pair and P(g|M) and (P(g|U) are the probabilities of observing that feature vector for a matched and nonmatched pair, respectively. Two thresholds based on desired error levels—T m and Tl—optimally separate the ratio values for equivalent, possibly equivalent, and nonequivalent record pairs. · When no training data in the form of duplicate and nonduplicate record pairs is available, matching can be unsupervised, where conditional probabilities for feature values are estimated using observed frequencies. · Because most record pairs are clearly non-matches, we need not consider them for matching. The way to manage this is to “block” the data bases, e.g., based on geography or some other variable in both data bases, so that only records in comparable blocks are compared. Such a strategy significantly improves efficiency. The first four components lay the groundwork for accuracy of record-pair matching using statistical techniques such as logistic regression, the EM algorithm, and Bayes networks (e.g., see Jaro 1995, Larson and Rubin 2001, and Winkler 2002). Accuracy is well-known to be high when there is a 1-1 match between records in the two systems and deteriorates as the overlap between the files decreases as well as with the extent of measurement error in the feature values. While the use of human review of possible matches has been an integral part of many statistical applications, it may well be infeasible for large-scale data warehousing. The fifth component provides for efficiently processing large data bases, but to the extent that blocking is approximate and possibly inaccurate its use decreases the accuracy of record pair matching. There are three potential lessons associated with this literature on matching and the methods it has produced: · If we are trying to protect against an intruder who would like to merge the data in a confidential data base with an external data base in his/her possession, then we need to assure ourselves and the intruder that the accuracy of matching is low and that individuals cannot be identified with high probability. We need to keep in mind that an intruder will have easy access to a host of identifiable public record systems. For example, as of September 7, 2005, SearchSystems.net4 listed 34,035 free searchable public record data bases on its website! · One strategy for protecting a data base against attack from an intruder is to split it into parts, perhaps overlapping, to decrease the likelihood of accurate matches. The parts should be immune from attack (with high probability) but of value for analytical purposes. For categorical data this might correspond to reporting lower-dimensional margins from a highdimensional contingency table, c.f., Dobra and Fienberg (2001, 2003),

10. Homeland Insecurity

205

and Fienberg and Slavkovic (2004). For continuous data we might need to apply disclosure protection methods to the split components, e.g., see Duncan et al. (2001) and Fienberg (2005a) for overviews. It is the uncertainty associated with efforts to concatenate the separate pieces that provides the confidentiality protection in both instances. The higher the uncertainty the better the protection. · Unless Choicepoint and other data warehousers are adding data into their files using unique identifiers such as Social Security numbers (and even Social Security numbers are not really unique!), or with highly accurate addresses and/or geography, some reasonable fraction of the data in their files will be the result of inaccurate and faulty matches. Data quality for data warehouses is an issue we all need to worry about, see Winkler (2005).

4.

ENCRYPTION, MULTI-PARTY COMPUTATION, AND PRIVACY-PRESERVING DATAMINING

If you search the WWW for “e-commerce” and “data privacy protection” you will find extensive discussion about firewalls, intrusion prevention (IPS) and intrusion detection (IDS) systems, and secure socket layer (SSL) encryption technology. Indeed, these technological tools are important for secure data transmission, statistical production, and offline data storage, c.f. Domingo-Ferrer et al. (2000). But encryption cannot protect the privacy of individuals whose data is available in online data bases! Among the methods advocated to carry out such data mining exercises are those that are described as privacy-preserving data mining (PPDM). PPDM typically refers to data mining computations performed on the combined data sets of multiple parties without revealing each party's data to the other parties. The data consist of possibly overlapping sets of variables contained in the separate data bases of the parties and overlapping sets of individuals. When the parties have data for the same variables but different individuals the data are said to be horizontally partitioned, whereas when the individuals are the same but the variables are different the data are said to be vertically partitioned. Here we are concerned with the more complex case involving both overlapping variables and overlapping sets of individuals. PPDM research comes in two varieties. In the first, sometimes referred to as the construction of “privacy-preserving statistical databases,” the data are altered prior to delivery for data mining, e.g., through the addition of random noise or some other form of perturbation. While these approaches share much in common with the methods in the literature on statistical disclosure limitation, they are of little use when it comes to the identification of

206

Chapter 10. Fienberg

terrorists. In the second variety, the problem is solved using what is known as “multi-party secure computation,” where no party knows anything except its own input and the results. The literature typically presumes that data are included without error and thus could be matched perfectly if only there were no privacy concerns. The methods also focus largely on situations where the results are of some computation, such as a dot product or the description of an association rule. See the related discussion in Fienberg and Slavkovic (2005). A major problem with the PPDM literature involving multi-party computation is that the so-called proofs of security are designed not to protect the individuals in the data base but rather the data base owners, as in the case of two companies sharing information but not wanting to reveal information about their customers to one another beyond that contained in the shared computation. Once the results of the data mining consist of linked extracts of the data themselves, however, the real question is whether one of the parties can use the extra information to infer something about the individuals in the other party’s data that would otherwise not be available. Secure computation is a technique for carrying out computations across multiple data bases without revealing any information about data elements found only in one data base. The technique consists of a protocol for exchanging messages. We assume the parties to be semi-honest—i.e., they correctly follow the protocol specification, yet attempt to learn additional information by analyzing the messages that are passed. For example, Agrawal et al. (2003) illustrate the secure computation notion via an approach to the matching problem for parties A and B. They introduce a pair of encryption functions E (known only to A) and E' (known only to B) such that for all x, E(E'(x)) = E'(E(x)). A’s data base consists of a list A and B’s consists of a list B. A sends B the message E(A); B computes E'(E(A)) and then sends to A the two messages E'(E(A)) and E'(B). A then applies E to E'(B), yielding E'(E(A)) and E'E(B)). A computes E'(E(A))ÇE'(E(B)). Since A knows the order of items in A, A also knows the order of items in E'(E(A)) and can quickly determine AÇB. The main problems with this approach are (1) it is asymmetric, i.e., B must trust A to send AÇB back, and (2) it presumes semi-honest behavior. Li et al. (2004) describe a variety of scenarios in which the Agrawal et al. protocol can easily be exploited by one party to obtain a great deal of information about the other's data base and they explain drawbacks of some other secure computation methods including the use of one-way hash-based schemes. As Dwork and Nissim (2004) note: “There is also a very large literature in secure multi-party computation. In secure multi-party computation, functionality is paramount, and privacy is only preserved to the extent that the function outcome itself does not reveal information about the

10. Homeland Insecurity

207

individual inputs. In privacy-preserving statistical data bases, privacy is paramount.” The problem with privacy-preserving data-mining methods for terrorist detection is that they seek the protection of the latter while revealing individual records using the functionality of the former. For more details on some of these and other issues, see Karr et al. (2005). The U.S. Congress and various private foundations have taken up the issue of privacy protection from government datamining activities especially in the post-9/11 world. For example, in its recent report, the U.S. Department of Defense Technology and Privacy Advisory Committee (TAPAC) (2004) has stressed the existence of a broad array of government data mining programs, and “disjointed,” “inconsistent,” and “outdated” laws and regulations protecting privacy. TAPAC recommended broad new actions to protect privacy, both within the Department of Defense and across agencies of the federal government. The long standing concern regarding surveillance of U.S. citizens and others by government agencies has been heightened during the war on terror, e.g., see Kreimer (2004) and especially most recently with the controversy over unauthorized domestic spying.5

5.

SELECTIVE REVELATION, RISK-UTILITY TRADEOFF, AND DISCLOSURE LIMITATION ASSESSMENT

To get around the privacy problems associated with the development of the TIA and MATRIX systems Tygar (2003a, 2003b) and others have advocated the use of what has come to be called “selected revelation,” involving something like the risk-utility tradeoff in statistical disclosure limitation. Sweeney (2005b) used the term to describe an approach to disclosure limitation that allows data to be shared for surveillance purposes “with a sliding scale of identifiability, where the level of anonymity matches scientific and evidentiary need.” This corresponds to a monotonically increasing threshold for maximum tolerable risk in the R-U confidentiality map framework described in Duncan et al. (2001), Duncan and Stokes (2004) and Duncan, McNulty and Stokes (2004), as depicted in Figure 10-1. Figure 10-2 depicts the basic selective revelation scheme described in a committee report on TIA privacy methodology (ISAT:2002). The TIA privacy report (ISAT, 2002) suggests that Selective revelation works by putting a security barrier between the private data and the analyst, and controlling what information can flow

208

Chapter 10. Fienberg

Figure 10-1. R-U Confidentiality Maps For Two Different Disclosure Limitation Methods With Varying Parameter Settings. Adapted from Duncan and Stokes (2004)

across that barrier to the analyst. The analyst injects a query that uses the private data to determine a result, which is a high-level sanitized description of the query result. That result must not leak any private information to the analyst. Selective revelation must accommodate multiple data sources, all of which lie behind the (conceptual) security barrier. Private information is not made available directly to the analyst, but only through the security barrier. One effort to implement this scheme was dubbed privacy appliances by Lunt (2003) and it was intended to be a stand-alone device that would sit between the analyst and the private data source so that private data stays in authorized hands. These privacy controls would also be independently operated to keep them isolated from the government. According to Lunt (2003) the device would provide: · Inference control to prevent unauthorized individuals from completing queries that would allow identification of ordinary citizens. · Access control to return sensitive identifying data only to authorized users. · Immutable audit trail for accountability. Implicit in the TIA Report and in the Lunt approach was the notion that linkages across data bases behind the security barrier would utilize identifiable records and thus some form of multi-party computation method involving encryption techniques. Popp and Poindexter (2006) give a similar account.

10. Homeland Insecurity

209

Figure 10-2. Idealized Selective Revelation Architecture. Adapted from ISAT (2002)

The real questions of interest in “inference control” are (1) What disclosure limitation methods should be used? (2) To which data bases should they be applied? and (3) How can the “inference control” approaches be combined with the multi-party computation methods? Here is what we know in the way of answers: · Both Sweeney (2005b) and Lunt (2005) refer to Sweeney's version of micro-aggregation, known as k-anonymity, but with few details on how it could be used in this context. This methodology combines observations in groups of size k and reports either the sum or the average of the group for each unit. The groups may be identified by clustering or some other statistical approach. Left unsaid is what kinds of users might perform with such aggregated data. Further, neither k-anonymity nor any other confidentiality tool does anything to cope with the implications of the release of exactly-linked files requested by “authorized users.” · Much of the statistical and operations research literature on confidentiality fails to address the risk utility trade-off, largely by focusing primarily only on privacy, or on technical implementations without understanding how users wish to analyze a data base, e.g., see Gopal, Garfinkel and Goes (2002). · A clear lesson from the statistical disclosure limitation literature is that privacy protection in the form of “safe releases” from separate data bases does not guarantee privacy protection for a merged data base. A figure in Lunt (2005) demonstrates recognition of this fact by showing privacy

210

Chapter 10. Fienberg

appliances applied for the individual data bases and then, again, independently for the combined data. To date there have been a limited number of crosswalks between the statistical disclosure limitation literatures on multi-party computation and risk-utility tradeoff choices for disclosure limitation. Yang, Zhong, and Wright (2005) provide a starting point for discussions on k-anonymity. There are clearly a number of alternatives to k-anonymity, and ones which yield “anonymized” data bases of far greater statistical utility! The hype associated with the TIA approach to protection has abated, but largely because TIA no longer exists as an official program. But similar programs continue to appear in different places in the federal government and no-one associated with any of them has publicly addressed the privacy concerns raised here regarding the TIA approach. When the U.S. Congress stopped the funding for DARPA’s TIA program in 2003, Lunt's research and development effort at PARC Research Center was an attendant casualty. Thus to date there have been no publiclyavailable prototypes of the privacy appliance, nor are there likely to be in the near future. The claims of privacy protection and selective revelation continue with MATRIX and other data warehouse systems, but without an attendant research program, and the federal government continues to plan for the use of data mining techniques in other federal initiatives such as the Computer Assisted Passenger Profiling System II (CAPPS II). Similar issues arise in the use of government, medical and private transactional data in bio-terrorism surveillance, e.g., see Fienberg and Shmueli (2005) and Sweeney (2005a).

6.

ANALYZING NETWORK DATA BASED ON TRANSACTIONS

Transactions can often be described in terms of networks, e.g., in the form of graphs G(V,E) with vertices (nodes), V, corresponding to units or individuals and edges, E, corresponded to the transactions. If unit i sends something to unit j, then there is a directed edge connecting them. Much of the DARPA initiative linked to TIA was focused on link mining of transaction data bases, e.g., see the summary in Senator (2005). For discussion of related machine learning methodologies see the papers in the special issue of SIGKDD Explorations on link mining (Getoor and Diel, 2005). This problem has been in the news very recently because of the controversy over the access by the National Security Agency to the

10. Homeland Insecurity

211

telephone log records of millions of Americans (or attempted access). Clearly such log records can be represented in network form. The claim has been made that such data will be used to discover linkages among individuals in a terrorist cell. This can typically be done in one of two ways: 1. By looking at telephone links to and from known or suspected terrorists. Issue: how far out do we look for links, and how do we distinguish between terrorist links and links that represent everyday life–ordering take-out meals from a pizza parlor or calling neighbors or work colleagues at home. 2. By using a “template” or signature for a terrorist cell and sifting the entire data base of linkages looking for cliques that resemble the signature. Issues: One needs to discover one or more terrorist network templates, and distinguishing them from other sub-networks and cliques that present similar pattern. Much has been made of efforts to retrospectively discover linkages among the 20 9-11 terrorists, using publicly available information from newspapers and the WWW, as well as from various transaction data bases. Krebs (2005) gives a detailed discussion of the use of publicly available data to construct the terrorist network reproduced here in Figure 10-3, but he also notes that he only needed to look at links between known individuals and retrospectively. He provides little information on how many others there are to whom these twenty are linked in multiple transaction data bases and what one might do with those links if we didn’t have definitive information on which individuals composed a terrorist cell. Krebs discusses how one might move towards this kind of prospective analysis, but much of what he suggests is speculation at best. See also the related discussions in the other papers that appear in the 2005 special issue of Connections on this topic, available online. 6 Despite the extensive literature on link mining and social network analysis there seems to be limited progress at best in understanding how we can use transaction data bases to identify terrorist cells or networks. The size of the telephone log records data bases makes searching for “signatures” especially problematic. 7 Schneier (2006) has claimed: “Finding terrorism plots is not a problem that lends itself to data mining. It's a needle-in-ahaystack problem, and throwing more hay on the pile doesn't make that problem any easier.” Viewed from the perspective of risk-utility tradeoff, the use of large-scale transaction data bases appears to have high privacy risk and low utility, at least given the current state of data mining and privacy-protection methodology.

Chapter 10. Fienberg

212

Figure 10-3. Network map of the 9-11 terrorist networks based on public information. The hijackers are coded by the flight they were on. The circle nodes are others who were reported to have had direct, or indirect, interactions with the hijackers. Source: Adapted from V. Krebs 8 (2005).

7.

CONCLUSIONS

Data privacy protection is a major issue for government administrative data bases, data collected by commercial organizations, especially for ecommerce. (Fienberg 2006). While solutions like SSL encryption may help companies with protection for confidential data transmission, the privacy pitfalls of data bases of all sorts are constantly in the news and at issue. In this paper, we have focused on both transaction data bases and on large-scale data warehousing in part because the repeated announcements of security breaches in systems operated by the major vendors such as Acxiom, ChoicePoint, and LexusNexus have filled our morning newspapers during the past several years. The public and civil rights groups have argued that this is just the tip of the privacy-violation iceberg and they have called for government intervention and legal restrictions on both public and private organizations with respect to data warehousing and data mining. The

10. Homeland Insecurity

213

lessons from such privacy breaches extend easily to virtually all electronically accessible data bases. Companies need to take data security seriously and implement “best practices,” and they need to rethink their policies on “data access” by others. As the recent “thefts” of 26.5 million records from the Department of Veterans Affairs9 and of 1,500 records at a National Nuclear Security Administration center in Albuquerque10 makes clear, government agencies are just as vulnerable (U.S. GAO 2006b). The giant data warehouses described in this paper have been assembled through the aggregation of information from many separate data bases and transactional data systems. They depend heavily on matching and record linkage methods that intrinsically are statistical in nature, and whose accuracy deteriorates rapidly in the presence of serious measurement error. Data mining tools can't make up for bad data and poor matches, and someone beyond “wronged consumers” will soon begin to pay attention. Should you worry about these data warehouses? With very high probability they contain data on you and your household, but you will never quite know what data or how accurate the information is. And soon the data may be matched into a government-sponsored terrorist search systems such as the one being set up by the Transportation Security Administration (TSA) to match passenger lists into a consolidated watch list of suspected terrorists. On September 19, 2005, the “Secure Flight” Working Group to the Transportation Security Administration (TSA) submitted a report questioning TSA's secrecy regarding what data it plans to use and how (Secure Flight Working Group 2005): The TSA is under a Congressional mandate to match domestic airline passenger lists against the consolidated terrorist watch list. TSA has failed to specify with consistency whether watch list matching is the only goal of Secure Flight at this stage.... Will Secure Flight be linked to other TSA applications? ... How will commercial data sources be used? One of the most controversial elements of Secure Flight has been the possible uses of commercial data. TSA has never clearly defined two threshold issues: what it means by “commercial data;” and how it might use commercial data sources in the implementation of Secure Flight. TSA has never clearly distinguished among various possible uses of commercial data, which all have different implications. The story continues, however, since a few months later it was revealed that TSA had purchased a database from ChoicePoint to be matched against the watch list.11

Chapter 10. Fienberg

214

None of these comments nor the discussion in this paper is intended to imply that the government should not share data bases across agencies, either for statistical purposes or to support homeland security initiatives (U.S. GAO, 2006a). Rather we stress that such data sharing needs to be done with care and due attention to privacy and confidentiality concerns. Finally, we want to stress the need for new computational and statistical technologies to protect linked multiple data bases from privacy protection in the face of commercial and government queries. Slogans like “selective revelation” are not enough without technical backup. This might be provided by the serious integration of research ideas emanating from the statistical disclosure and cryptography communities. The technologies that result from such collaborative research must be part of the public domain, because only then can we evaluate their adequacy.

8.

ACKNOWLEDGMENTS

The research reported here was supported in part by NSF grants EIA– 9876619 and IIS–0131884 to the National Institute of Statistical Sciences and by Army contract DAAD19-02-1-3-0389 to CyLab at Carnegie Mellon University. This paper is based in part on an earlier and much shorter paper focusing on homeland security issues presented at the 2005 session of the International Statistical Institute and a related paper on e-commerce and security which appeared in Statistical Science, as well as an article in a Carnegie Mellon University publication, Focus, on the Hunt for Terrorists, and parts of those papers are reproduced here with permission. I have benefited from conversations with Chris Clifton, Cynthia Dwork, Alan Karr, and Latanya Sweeney about the material described here but they bear no responsibility for how I have represented their input.

NOTES 1 2

3 4 5

6 7

http://www.aclu.org/pizza/ Mark Clayton, “US Plans Massive Data Sweep,” Christian Science Monitor, February 09, 2006. http://www.csmonitor.com/2006/0209/p01s02-uspo.html. c.f., U.S. Government Accountability Office (2007). Shane Harris, “TIA Lives On,” National Journal, Thursday, Feb. 23, 2006. http://www.searchsystems.net/ David Johnston and Neil A. Lewis, “Domestic surveillance: The White House; Defending Spy Program, Administration Cites Law,” New York Times, December 23, 2005. http://www.insna.org/Connections-Web/Volume26-2/Cover26-2.htm Paitience Wait, “Too much for NSA to mine?” Government Computer News, May 22, 2006. http://appserv.gcn.com/cgi-bin/udt/im.display.printable?client.id=gcn&story.

10. Homeland Insecurity

215

id=40827 http://www.orgnet.com/hijackers.html 9 “Stolen VA Data Goes Beyond Initial Reports,” New York Times, May 31, 2006. http://www.nytimes.com/aponline/us/AP-Vets-ID-Theft.html 10 David Stout, “Data Theft at Nuclear Agency Went Unreported for 9 Months,” New York Times, June 10, 2006. http://www.nytimes.com/2006/06/10/washington/10identity.html 11 “TSA Chief Suspends Traveler Registry Plans,” Associated Press, February 9, 2006. 8

REFERENCES Agrawal R. Evfimievski A, and Srikant R (2003) Information sharing across private databases. In Proceedings of the 2003 ACM SIGMOD International Conference on Management of Data, San Diego, CA Bilenko M, Mooney R, Cohen WW, Ravikumar P, Fienberg, SE (2003) Adaptive namematching in information integration. IEEE Intelligent Systems 18: 16–23 Bishop YMM, Fienberg SE, Holland PW (1975) Discrete Multivariate Analysis: Theory and Practice. MIT Press, Cambridge MA. Reprinted by Springer-Verlag, 2007 Clarke R (1988) Information technology and dataveillance. Communications of the ACM 31:498–512 Dobra A, Fienberg SE (2001) Bounds for cell entries in contingency tables induced by fixed marginal totals. Statistical Journal of the United Nations ECE 18: 363–371 Dobra A, Fienberg SE (2003) Bounding entries in multi-way contingency tables given a set of marginal totals. In Y Haitovsky, HR Lerche, and Y Ritov, eds., Foundations of Statistical Inference: Proceedings of the Shoresh Conference 2000, Springer-Verlag, Berlin, 3–16 Domingo-Ferrer JM, Mateo-Sanz JM, and S\'anchez del Castillo, RX (2000). Cryptographic techniques in statistical data protection. Proceedings of the Joint UN/ECE-Eurostat Work Session on Statistical Data Confidentiality, Office for Official Publications of the European Communities, Luxembourg, 159–166 Domingo-Ferrer J, Torra V (2003) Statistical data protection in statistical microdata protection via advanced record linkage. Statistics and Computing 13: 343–354 Duncan GT (2001) Confidentiality and statistical disclosure limitation. International Encyclopedia of Social & Behavioral Sciences, Elsevier, Amsterdam, 2521–2525 Duncan GT, Fienberg SE, Krishnan R, Padman R, Roehrig SF (2001) Disclosure limitation methods and information loss for tabular data. In P Doyle, J Lane, J Theeuwes, and L Zayatz, eds., Confidentiality, Disclosure and Data Access: Theory and Practical Applications for Statistical Agencies, Elsevier, Amsterdam, 135–166 Duncan GT, Keller-McNulty SA, Stokes SL (2004) Database security and confidentiality: Examining disclosure risk vs. data utility through the R-U confidentiality map. Technical Report Number 142, National Institute of Statistical Sciences, March, 2004 Duncan GT, Stokes SL (2004) Disclosure risk vs. data utility: The R-U confidentiality map as applied to topcoding. Chance,17(No. 3): 16–20 Dwork C, Nissim K (2004) Privacy-preserving data mining in vertically partitioned databases. Proc. CRYPTO 2004, 24th International Conference on Cryptology, University of California, Santa Barbara Fellegi IP, Sunter AB (1969) A theory for record linkage. Journal of the American Statistical Association, 64:1183–1210

216

Chapter 10. Fienberg

Fienberg SE (2005a) Confidentiality and disclosure limitation. Encyclopedia of Social Measurement, Elsevier, Amsterdam, 463–469 Fienberg SE (2005b) Homeland insecurity: Datamining, terrorism detection, and confidentiality. Bulletin of the International Statistical Institute, 55th Session: Sydney 2005 Fienberg SE, Shmueli G (2005) Statistical issues and challenges associated with rapid detection of bio-terrorist attacks. Statistics in Medicine 24: 513–529 Fienberg SE, Slavkovic AB (2004) Making the release of confidential data from multi-way tables count. Chance 17(No. 3): 5–10 Fienberg SE, Slavkovic AB (2005) Preserving the confidentiality of categorical statistical data bases when releasing information for association rules. Data Mining and Knowledge Discovery 11:155–180 Getoor L, Diehl CP (2005) Introduction: Special issue on link mining. SIGKDD Explorations, 7(2):76–83 Gopal R, Garfinkel R, Goes P (2002) Confidentiality via camouflage. Operations Research 50:501–516 ISAT–Information Science and Technology Study Group on Security and Privacy (chair: JD Tygar) (2002) Security With Privacy. December 13, 2002 Briefing Jaro MA (1995) Probabilistic linkage of large public health data files. Statistics in Medicine 14:491–498 Karr AF, Lin X, Sanil AP, Reiter, JP (2006) Secure statistical analysis of distributed databases. In D Olwell and AG Wilson, eds., Statistical Methods in Counterterrorism, Springer-Verlag, New York, in press Krebs VE (2005) Mapping networks of terrorist cells. Connections 24(3): 43-52 http://www.insna.org/Connections-Web/Volume24-3/Valdis.Krebs.web.pdf Kreimer SF (2004) Watching the watchers: Surveillance, transparency, and political freedom in the war on terror. Journal of Constitutional Law 7: 133–181 Larsen MD, Rubin DB (2001) Alternative automated record linkage using mixture models. Journal of the American Statistical Association 79: 32–41 Li Y, Tygar JD, Hellerstein JM (2005) Private matching. Chapter 3 in D. Lee, S. Shieh, and J.D. Tygar, eds., Computer Security in the 21st Century, Springer-Verlag, New York, 25– 50 Lunt T (2003) Protecting privacy in terrorist tracking applications. Presentation to Department of Defense Technology and Privacy Advisory Committee, September 29, 2003 http://www.sainc.com/tapac/library/Sept29/LuntPresentation.pdf Lunt T, Staddon J, Balfanz D, Durfee G, Uribe T, and others (2005) Protecting privacy in terrorist tracking applications. Powerpoint presentation. http://research.microsoft.com/projects/SWSecInstitute/five-minute/Balfanz5.ppt Muralidhar KR, Parsa K, Sarathy R (2001) An improved security requirement for data perturbation with implications for e-commerce. Decision Sciences 32: 683–698 Popp, R, Poindexter, J (2006) Countering terrorism through information and privacy protection technologies. IEEE Security & Privacy, 4 (6): 18-27 Privacy Office (2006) Report to the Public Concerning the Multistate Anti-Terrorism Information Exchange (MATRIX) Pilot Project. U. S. Department of Homeland Security, December, 2006 Relyea HC, Seifert JW (2005) .Information Sharing for Homeland Security: A Brief Overview. Congressional Research Service, Library of Congress (Updated January 10, 2005)

10. Homeland Insecurity

217

Secure Flight Working Group (2005) Report of Secure Flight Working Group. Presented to the Transportation Security Administration, September 19, 2005 Schneier, B (2006) We're giving up privacy and getting little in return, Minneapolis Star Tribune, May 31, 2006, http://www.startribune.com/562/v-print/story/463348.html Senator, TE (2005) Link mining applications: Progress and challenges. SIGKDD Explorations, 7(2): 76–83 Sweeney L (2005a) Privacy-preserving bio-terrorism surveillance. AAAI Spring Symposium, AI Technologies for Homeland Security Sweeney L (2005b) Privacy-preserving surveillance using selective revelation. Carnegie Mellon University, LIDAP Working Paper 15, February 2005. (PDF) Sweeney L (2005c) Privacy-enhanced linking. SIGKDD Explorations, 7(2): 72–75 Tygar JD (2003a) Privacy architectures. Presentation at Microsoft Research, June 18, 2003. http://research.microsoft.com/projects/SWSecInstitute/slides/Tygar.pdf Tygar JD (2003b) Privacy in sensor webs and distributed information systems. In M Okada, B Pierce, A Scedrov, H Tokuda, A Yonezawa, eds., Software Security, Springer-Verlag, New York, 84–95 U.S. Department of Defense Technology and Privacy Advisory Committee (TAPAC) (2004) Safeguarding Privacy in the Fight Against Terrorism. U.S. General Accounting Office (2004) Data Mining: Federal Efforts Cover A Wide Range of Uses. GAO-04-548, Report to the Ranking Minority Member, Subcommittee on Financial Management, the Budget, and International Security, Committee on Governmental Affairs, U.S. Senate, Washington, DC U.S. Government Accountability Office (2006a) Information Sharing: The Federal Government Needs to Establish Policies and Processes for Sharing Terrorism-Related and Sensitive but Unclassified Information. GAO-06-385 March 17, 2006. U.S. Government Printing Office, Washington, DC U.S. Government Accountability Office (2006b) Privacy: Preventing and Responding to Improper Disclosures of Personal Information. GAO-06-833T June 8, 2006. U.S. Government Printing Office, Washington, DC U.S. Government Accountability Office (2007) Datamining: Early Attention to Privacy in Developing a Key DHS Program Could Reduce Risks. GAO-07-293 February 2007 U.S. Government Printing Office, Washington, DC Winkler WE (2002) Record Linkage and Bayesian Networks. Proceedings of the Section on Survey Research Methods, American Statistical Association, CD-ROM Winkler WE (2005) Data Quality in Data Warehouses. In J Wang, ed., Encyclopedia of Data Warehousing and Data Mining, Idea Group Publishing, Hershey, PA Yang Z, Zhong S, Wright RN (2005) Privacy-Enhancing k-anonymization of customer data. 24th ACM SIGMOD International Conference on Management of Data/Principles of Database Systems (PODS 2005)

SUGGESTED READINGS · Doyle P, Lane J, Theeuwes J, and Zayatz L, eds., (2001) Confidentiality, Disclosure and Data Access: Theory and Practical Applications for Statistical Agencies. Elsevier, Amsterdam

218

Chapter 10. Fienberg

· Duncan GT, Jabine TB, and de Wolf VA (1993) Private Lives and Public Policies: Confidentiality and Accessibility of Government Statistics. Panel on Confidentiality and Data Access, Washington DC: National Academy Press · Vincent B, Kendall LS (2002) Social Netwoks and Trust. Dordrecht: Kluwer · Schneier B (2003) Beyond Fear: Thinking Sensibly about Security in an Uncertain World. New York: Copernicus Books · Winkler WE (1995) Matching and Record Linkage, in B. G. Cox et al. (ed.) Business Survey Methods, New York: Wiley, 355-384

DISCUSSION QUESTIONS 1. Locate a copy of the Privacy Act of 1974. To what extent are the provisions of the Act compatible with the use of data mining of large government and commercial data bases in the hunt for terrorists? 2. The United States Department of Homeland Security is attempting to create a consolidated database of biometric and biographic data for individuals who voluntarily exchange personally identifiable information in return for expedited transit at U.S. border entry points. How could such a data base be used in the hunt for terrorists? 3. Security expert Bruce Schneier (2006) has claimed: “Finding terrorism plots is not a problem that lends itself to data mining. It's a needle-in-ahaystack problem, and throwing more hay on the pile doesn't make that problem any easier. We'd be far better off putting people in charge of investigating potential plots and letting them direct the computers, instead of putting the computers in charge and letting them decide who should be investigated.” Explain the reasoning here in the context of statistical models for networks. 4. Compile a list of government, commercial, and other data bases in which data on you or your family might be included. Can you access the information on you and verify its correctness? 5. How can encryption be used to protect privacy but at the same time allow linkage of data across databases?

Unit 2

TERRORISM INFORMATICS TO SUPPORT PREVENTION, DETECTION, AND RESPONSE

11 CASE STUDY OF JIHAD ON THE WEB A Web Mining Approach Hsinchun Chen1, Jialun Qin2, Edna Reid3, Yilu Zhou4, and Marc Sageman5 1

Management Information Systems, The University of Arizona, Tucson, Arizona, U.S.A. ([email protected]); 2Department of Management, University of MassachusettsLowell, Lowell, Massachusetts, U.S.A.; ([email protected]) 3Department of Library Science, Clarion University, Clarion, Pennsylvania, U.S.A. ([email protected]); 4Information Systems & Technology Management Department, George Washington University, Washington D.C., U.S.A. ([email protected]); 5Sageman Consulting, LLC, Rockville, Maryland, U.S.A. ([email protected])

CHAPTER OVERVIEW Terrorist and extremist groups and their sympathizers have found a costeffective resource to advance their courses by posting high-impact Websites with short shelf-lives. Because of their evanescent nature, terrorism research communities require unrestrained access to digitally archived Websites to mine their contents and pursue various types of analyses. Organizations that specialize in capturing, archiving, and analyzing Jihad terrorist Websites employ different, manual-based analysis techniques that are ‘hidden’ from the research communities. This chapter proposes the development of automated or semi-automated procedures and systematic methodologies for capturing Jihad terrorist Website data and its subsequent analyses. By analyzing the content of hyperlinked terrorist Websites and constructing visual social network maps, our study is able to generate an integrated approach to the study of Jihad terrorism, their network structure, component clusters, and cluster affinity.

221

222

1.

Chapter 11. Chen et al.

INTRODUCTION

With weekly news coverage of excerpts from videos produced and webcasted by terrorists, it has become obvious that terrorists have further exploited the Internet beyond routine communication and propaganda operations to better influence the outside world. Some warn that the Internet allows terrorist groups to acquire sensitive intelligence information and control their operations [19] while others argue that terrorists use the Internet to develop a world-wide command, control, communication and intelligence system (C3I). Jenkins posited that terrorists have used the Internet as a broadcast platform for the “terrorist news network” [12], which is an effective tactic because they can reach a broad audience with relatively little chance of detection. Although this alternate side of the Internet, referred to as the “Dark Web” has recently received extensive government and media attention, our systematic understanding of how terrorists use the Internet for their campaign of terror is limited. According to studies by the Institute for Security and Technology Studies (ISTS) at Dartmouth College [11] and Anderson [2], there is a need to address this under-researched issue. In this study, we explore an integrated approach for harvesting Jihad terrorist Websites to construct a high quality collection of Website data that can be used to validate a methodology for analyzing and visualizing how Jihad terrorists use the Internet, especially the World Wide Web, in their terror campaigns. Jihad terrorist Websites are Websites produced or maintained by Islamic extremist groups or their sympathizers. In this study, we answer the following research questions: What are the most appropriate techniques for collecting high-quality Jihad terrorism Web pages? What are systematic approaches for analyzing and visualizing Jihad terrorist information on the Web so as to identify usage and relationships among groups? How does content analysis of the Jihad terrorists’ collection help reveal the terrorist’s ideology, propaganda, and communication patterns?

2.

PREVIOUS RESEARCH

2.1

Terrorist Websites

Information technology, especially the Internet, has heightened the whole spectrum of conflict by giving rise to networked forms of terrorism organizations, doctrines and strategies. Arquilla and Ronfeldt [3] described this trend as netwar, an emerging model of conflict in which the protagonists

11. Case Study of Jihad on the Web

223

use network forms of organization and exploit information technology. Since networks can be diverse, redundant, and lack centralized control, terrorist groups with network structures create new challenges for governments and researchers to monitor, analyze, and counter. Arquilla and Ronfeldt’s research stimulated several investigations into terrorists’ use of the Internet such as Elison [9], Tsfati and Weimann [21], ISTS [11], and Weimann [22]. All of them used terrorists’ and their sympathizers’ Websites as their primary data sources and provided brief descriptions of their methodologies. For example, Elison used search engines to identify the group’s official Websites and manually analyzed its narratives, graphics, and hyperlinks. He also analyzed newsgroup messages to understand how the group may be affecting public opinion. Although an increasing number of terrorists’ Websites are posted on the Internet, they are also very dynamic and have short shelf-lives: they emerge overnight, disappear by changing their URLs, and are often shut down. To ensure controlled access to terrorist Websites for research and intelligence analyses, several organizations are collecting, archiving, and analyzing Jihad terrorist Websites. These organizations can be grouped into three areas: archive, research community, and vigilante group. For the archive group, the Internet Archive has been spidering the Web and collecting Webpages every two months since 1996. However, it is not comprehensive and is technically limited by factors such as database access, password protection and Java script which inhibit its full capture capability [14]. The research community, the second group, includes the Project for Research of Islamist Movements, (PRISM) at the Interdisciplinary Center Herzliya, the Jihad and Terrorism Studies Project at the Middle East Research Institute (MEMRI), the Search for International Terrorist Entities (SITE Institute), and Professor Gabriel Weimann’s collection at the University of Haifa, Israel [17]. Although all of them manually capture and analyze terrorist Websites to publish research reports, none publish their specific collection building and analytical approaches. The Internet Haganah is an example for the third group because it is made up of self-appointed volunteers who surf the Web to identify and download terrorist Websites for inclusion in their database of Jihad sites. Later, they contact authorities to report suspicious activities as they try to get Websites closed down. Except for using search engines to identify terrorist Websites, none of the organizations seem to use any other automated methodologies for capturing and analyzing terrorist Websites.

2.2

Web Harvesting Approaches

The first step towards studying the terrorism Web infrastructure is to

224

Chapter 11. Chen et al.

harvest terrorist Websites back to a local repository for further analysis. Web harvesting is the process of gathering and organizing unstructured information from pages and data on the Web [13]. Previous studies have suggested 3 types of approaches to harvesting Web contents in specific domains: manual approach, automatic approach, and semiautomatic approach. In order to build the September 11 and Election 2002 Web Archives [18], the Library of Congress’ approach was to manually collect seed URLs for a given theme. The seeds and their close neighbors (distance 1) are then downloaded. The limitation of such a manual approach is that it is timeconsuming and inefficient. Albertsen [1] used an automatic approach in the “Paradigma” project. The goal of Paradigma is to archive Norwegian legal deposit documents on the Web. It employed a focused Web crawler, an automatic program that discovers and downloads Websites in particular domains by following Web links found in the HTML pages of a starting set of Web pages. Metadata was then extracted and used to rank the Websites in terms of relevance. The automatic approach is more efficient than the manual approach; however, due to the limitations of current focused crawling techniques, automatic approaches often introduce noise (off-topic Web pages) into the harvest results. The “Political Communications Web Archiving” group employed a semiautomatic approach to harvesting domain-specific Websites [16]. Domain experts provided seed URLs as well as typologies for constructing metadata that can be used in the crawling process. Their project’s goal is to develop a methodology for constructing an archive of broad-spectrum political communications over the Web. We believe that semiautomatic approach is the most suitable one for harvesting terrorism Websites because it combines the high accuracy and high efficiency of manual and automatic approaches.

2.3

Web Link and Content Analysis

Once the terrorist Websites are harvested, two types of analysis can be applied to study the terrorists’ use of the Web: Hyperlink analysis and Web content analysis. Hyperlink analysis has been previously used to discover hidden relationships among communities [10]. Borgman [4] defines two classes of web link analysis studies: relational and evaluative. Relational analysis gives insight into the strength of relations between Web entities, in particular Websites, while evaluative analysis reveals the popularity or quality level of a Web entity. In this study, we are more concerned with relational analysis

11. Case Study of Jihad on the Web

225

as it may bring us insight into the nature of relations among terrorist Websites and, possibly, terrorist organizations. Gibson [10] describes a methodology for discerning Web communities on the WWW. His work is based on Hyperlink-Induced Topic Search (HITS), an algorithm that identifies for authoritative hypermedia on a broad topic. In contrast, we construct a Website topology from a high quality Jihad Terrorism collection. Reid [15] made use of hyperlink-based topologies to uncover companies’ non-customer online communities. Our goal is to visualize and analyze hidden Jihad terrorism hyperlinked communities and inter-community relationships. In order to reach an understanding of the various facets of Jihad terrorism Web usage and communications, a systematic analysis of the Websites’ content is required. Researchers in the terrorism domain have traditionally ignored existing methodologies for conducting a systematic content analysis of Website data [21,11]. In Bunt’s [5] overview of Jihadi movements’ presence on the Web, he describes the reaction of the global Muslim community to the content of terrorist Websites. His assessment of the influence such content has on Muslims and Westerners is based on a qualitative analysis of extracts from Taliban and Al-Qaeda Websites. Tsfati and Weimann’s [21] study of terrorism on the Internet acknowledges the value of conducting a systematic and objective investigation of the characteristics of terrorist groups’ communications. Nevertheless, they claim that the small size of their collection and the descriptive nature of their research questions make a quantitative study infeasible. It may be unreasonable to conduct a quantitative analysis if only a small collection is available. Conversely, we believe Jihad terrorism content on the Web falls under the category of communicative contents and a quantitative analysis is critical for a study to be objective. Demchak and Friis’ [8] work provides a well-defined methodology for analyzing communicative content in government Websites. Their work focuses on measuring “openness” of government Websites. To achieve this goal they developed a Website Attribute System tool that is basically composed of a set of high level attributes such as transparency and interactivity. Each high level attribute is associated with a second layer of attributes at a more refined level of granularity. For example, the right “operational information” and “responses” on a given Webpage can induce an increase in the interactivity level of a government Website. This system is an example of a well-structured and systematic content analysis exercise. Demchak and Friis’ work provides guidance for the present study.

3.

PROPOSED APPROACH

226

Chapter 11. Chen et al.

We propose an integrated approach to the study of Jihad Terrorism Web infrastructure. We combine a sound semiautomatic methodology for harvesting and constructing a high quality Jihad terrorism collection, a hyperlink analysis and node clustering algorithm for the study of hyperlinked Jihad terrorism communities, and a systematic and deep content analysis of our dataset. To achieve our goal, we have developed a three step process: first, we construct a high quality Jihad terrorism collection, and then conduct link analysis on the collection to induce a network of Jihadi Web communities. Finally, we perform a systematic content analysis of the Websites in the collection.

3.1

Jihad Collection Building Process

A systematic and sound methodology for collecting the Jihad terrorism Websites guarantees that our collection, which is the cornerstone of the study, is comprehensive and representative. Hence, we take a three step systematic approach to construct the collection: 1) Identify seed URLs of Jihad terrorism groups and perform backlink expansion: The first task is to find a small set of Jihad terrorism Websites. To identify terrorist groups, we completely relied on the US Department of State’s list of foreign terrorist organizations. In particular, we only selected Middle-Eastern terrorist organizations from that list. After identifying the terrorist groups in the Middle-East region we manually search major search engines (google.com, yahoo.com …etc) to find Websites of these groups. Our goal here is not to construct a comprehensive list of URLs. We are merely compiling a very small list of URLs that can serve as the seeds for backlink expansion. The backlink search is then automatically performed and a collection of Websites is automatically retrieved. 2) Manual filter of the collection: Because bogus or unrelated terrorist sites can make their way into our collection, we have developed a robust filtering process based on evidence and clues from the Websites. Aside from sites which explicitly identify themselves as the official sites of a terrorist organization or one of its members, a Website that contains even minor praise of or adopts ideologies espoused by a terrorist group is included in our collection. All other Websites are excluded. 3) Extend the search manually: To ensure the comprehensiveness of our collection we augment the collection by means of manual search. Based on the backlink search results, we construct a short lexicon of Jihad terrorism. The lexicon is then used to manually search major search engines. The Websites that are found are then filtered using the same rules used for filtering the backlink search results.

11. Case Study of Jihad on the Web

3.2

227

Hyperlink Analysis on Jihad Collection

Our goal here is to shed light on the infrastructure of Jihad Websites and to provide the necessary tools for further analysis of Jihad terrorist group relationships. We believe the exploration of hidden Jihadi communities over the Web can give insight into the nature of relationships between Websites of the same group as well as relationships between the Websites of different groups. Moreover, from these relationships we can conjecture the existence of real-world communication channels between terrorist groups themselves. In fact, as we will show later, the virtual hyperlinked communities and their interactions conform to the current geopolitical structure of Middle-Eastern terrorist groups as recognized by terrorism experts. Uncovering hidden Web communities involves calculating a similarity measure between all pairs of Websites in our collection. We define similarity to be a real-valued multivariable function of the number of hyperlinks in Website “A” pointing to Website “B”, and the number of hyperlinks in Website “B” pointing to Website “A.” In addition, a hyperlink is weighted proportionally to how deep it appears in the Website hierarchy. For instance, a hyperlink appearing at the homepage of a Website is given a higher weight than hyperlinks appearing at a deeper level. The similarity matrix is then fed to a multidimensional scaling (MDS) algorithm which generates a two dimensional graph of the Websites. The proximity of nodes (Websites) in the graph reflects the similarity level.

3.3

Content Analysis on Jihad Collection

To better understand how Jihad terrorists use the Web to their own advantages, we propose a framework for analyzing the contents of Jihad Websites. The framework consists of 6 high level attributes, each of which is composed of multiple fine grained low level attributes. This approach is similar to what is presented in Demchak and Friis’ study [8]. Table 11-1 shows the high level and associated low level attributes used in this study. Table 11-1. Attributes used in the study High Level Attribute Low Level Attribute Email Communications Telephone Multimedia Online Feedback Form Documentation Fundraising External Aid Mentioned Fund Transfer Donation Charity

228

Chapter 11. Chen et al.

High Level Attribute Sharing Ideology

Propaganda (insiders)

Propaganda (outsiders) Virtual Community

Low Level Attribute Support Groups Mission Doctrine Justification of the use of violence Pin-pointing enemies Slogans Dates Martyrs Leaders Banners and Seals Narratives of operations and Events References to Western media coverage News reporting Listserv Text chat room Message board E-conferencing Web ring

We developed a set of coding schemes to identify the presence of each attribute in a Jihad Website. Using this coding scheme, human coders can easily identify whether or not the terrorists are using a Website for a particular purpose (e.g., fundraising, propaganda, etc) and to what extend they are using the Website for that purpose (by assigning a weight score to that attribute). Finally, the results of the content analysis are visualized using snowflake diagrams for easier understanding and comparison.

4.

ANALYSIS RESULTS

4.1

Collection of Jihad Websites

We identified three Websites: www.qudsway.com of the Palestinian Islamic Jihad, www.hizbollah.com of Hizbollah, and www.ezzedine.net which is a Website of the Izzedine-Al-Qassam, the military wing of Hamas. These Websites serve as seed URLs for the backlink search. Performing a one level deep backlink expansion using Google’s backlink search tool, we obtained a total of 88 sites. Going through each of the URLs, we then carefully followed the set of rules for filtering out the unrelated Websites. The filtering process reduced the initial set of 88 by about a third (only 26 sites were retained). Based on the 26 Websites we have identified in the previous step, we constructed a short lexicon of Jihad terrorism with the help of Arabic language speakers. Examples of highly relevant keywords included in the

11. Case Study of Jihad on the Web

229

lexicon are: “‫“( ”ﺣﺮب ﺻﻠﯿﺒﯿﺔ‬Crusader’s War”), “‫“( ”اﻟﻤﺠﺎھﺪﯾﻦ‬Moujahedin”), “‫“( ”اﻟﻜﻔﺎر‬Infidels”) …etc. This lexicon is utilized to do the manual search. The same rules used in the filtering process are used here to discern fake and unrelated websites. The manual search resulted in 13 additional Websites. A total of 39 Websites are classified by ideological affiliation (Table 11-2). Table 11-2. Middle-Eastern Terrorist Groups and Their Supporters’ Websites Web Site No. Terrorist Group Name URL Ideological Affiliation Terrorist Groups’ Web Sites 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23

24

25

Hizbollah Hamas Hizbollah Islamic Jihad Islamic Jihad Ezz-al-dine AlQassam Hizbollah Hamas Al Aqsa Martyr’s Brigades Chechen Rebels Hizbollah Hizbollah Hamas & Islamic Jihad Islamic Jihad Hamas Kahane Chai Mujahedin-e Khalq Mujahedin-e Khalq Mujahedin-e Khalq Mujahedin-e Khalq Mujahedin-e Khalq Mujahedin-e Khalq Revolutionary Peoples Liberation Army/Front Revolutionary Peoples Liberation Army/Front Lashkar-e Tayyiba

www.specialforce.net palestine-info-urdu.com web.manartv.org www.abrarway.com www.jimail.com www.ezzedeen.net

Shi’a Sunni Shi’a Sunni Sunni Sunni

www.hizbollah.tv www.infopalestina.com www.kataebalaqsa.com

Shi’a Sunni Secular

www.kavkaz.org.uk www.moqawama.tv www.nasrollah.org www.b-alshohda.com

Sunni Shi’a Shi’a Sunni

www.qudsway.com www.rantisi.net www.kahane.org www.iran.mojahedin.org www.iranncrfac.org www.siahkal.com www.fadai.org www.fadaian.org www.etehadefedaian.org www.dhkc.net

Sunni Sunni Jewish Secular Secular Secular Secular Secular Secular Secular

www.dhkc.info

Secular

jorgevinhedo.sites.uol.com.br

Sunni

www.al-ansar.biz www.alsakifah.org www.cihad.net www.clearguidance.com www.h-alali.net

Sunni Sunni Sunni Sunni Sunni

Supporters’ Web sites 26 27 28 29 30

Al Ansar Alsakifah Forum Cihad Clear Guidance Forum Sheikh Hamid Bin

230

Chapter 11. Chen et al.

Web Site No.

31 32 33 34 35 36 37 38

4.2

Terrorist Group Name

URL

Ideological Affiliation

Abdallah Al Ali Jihadunspun Maktab-Al-Jihad Qoqaz Supporters of Shareeah Moltaqa Saraya Osama Bin Laden Tawhed

www.jihadunspun.com www.maktab-al-jihad.com www.qoqaz.com www.shareeah.org www.almoltaqa.org www.saraya.com 1osamabinladen.5u.com www.tawhed.ws

Sunni Sunni Sunni Sunni Sunni Sunni Sunni Sunni

Jihad Collection Link Analysis Results

Following the procedure described in section 3.2 we have visualized the hidden hyperlinked communities in our collection (see Figure 11-1). Interestingly, domain experts recognized the existence of six clusters representing hyperlinked communities in the network. On the left side of the network resides the Hizbollah cluster. Hizbollah is a Lebanese militant organization. Established in 1982 during the Israeli invasion of Lebanon, the group routinely attacked Israeli military personnel until their pullout from south Lebanon in 2000. A cluster of Websites of Palestinian organizations inhabits the bottom left corner of the network: Hamas, Al-Aqsa Martyr’s Brigades, and the Palestinian Islamic Jihad. An interesting observation here is the link between the Hizbollah community and the Palestinian militant groups’ community. Hizbollah has traditionally sympathized with the Palestinian cause. In fact, it is widely believed that Hizbollah attempted to support Palestinian militant groups during the “Intifada”. Hence, it is not surprising at all to see a link between the two virtual communities. On the top left corner sits the Hizb-ut-Tahrir cluster. Hizb-ut-Tahrir is a political party with branches in many countries over the Middle-East and in Europe. Although the group was recently associated with Al-Qaeda, an apparent relation between the two groups has not been proven. In our network, Hizb-ut-Tahrir’s Websites are isolated and have hyperlinks to two other Websites: the Jihadunspun (www.jihadunspun.com) and the Tanzeem-e-Islami (www.tanzeem.org). Tanzeem-e-Islami is also a political party based in Pakistan. Although the two groups espouse extreme Islamist ideologies both are not officially recognized as terrorist groups. Indeed, the representing clusters in the network seem to be relatively isolated with the exception of a link between Tanzeem-e-Islami and Hizbollah and two links to www.jihadunspun.com. After investigating the nature of the link between Hizbollah and Tanzeem-e-Islami we found that only a single hyperlink pointing to Hizbollah’s Website was posted on Tanzeem-e-Islami’s site under a general

11. Case Study of Jihad on the Web

231

“Islamic Links” section. Looking at the bottom right corner one can see a cluster of Al-Qaeda affiliated sites. This cluster has links to two Websites of the radical Palestinian group Hamas. Al-Qaeda sympathizes with Palestinian groups. As well, some Palestinian Islamist groups like Hamas and Islamic Jihad share the same Salafi ideology with Al-Qaeda. In the top right hand corner, the Jihad Sympathizers Web community gathers Websites maintained by sympathizers of the Global Salafi movement. “kavkazcenter.net” and “clearguidance.com” are two Websites maintained by sympathizers of Chechen rebels [13]. “shareeah.com” is associated with Abu Hamza, a Muslim cleric who advocates extreme Salafi views. This community of Salafi sympathizers and supporters has links to three other major Sunni Web communities: the Al-Qaeda community, Palestinian extremists, and Hizb-ut-Tahrir communities. As expected the sympathizers community does not have any links to Hezbollah’s community as they follow radically different ideologies. Visualizing hyperlinked communities can lead to a better understanding of the underlying Jihad terrorism Web infrastructure. In addition, the visualization serves as a tool for showing the relationships among various hyperlinked communities. Furthermore, it helps foretell likely relationships between terrorist groups in the real world. Hizb-ut-Tahrir

Jihad Sympathizers

Tanzeem-e-Islami

Hizbollah Al-Qaeda linked Websites

Palestinian terrorist groups

Figure 11-1. The Jihad terrorism network with automatically generated hyperlinked communities.

232

4.3

Chapter 11. Chen et al.

Jihad Collection Content Analysis Results

We asked our domain expert to go through each Website in our collection and record the presence of low-level attributes based on our coding schema mentioned in section 3.3. For instance, the Web page of www.al-ansar.biz shown in Figure 11-2 contains a recording of “Sheikh Usama Bin Laden”. The presence of this recording contributes to the Website’s richness in terms of media and subsequently to the “Propaganda directed towards insiders” attribute.

Figure 11-2. A Webpage from www.al-ansar.biz featuring a downloadable recording of Usama Bin Laden

Figure 11-3. Snowflake Diagrams for Palestinian terrorist groups and Jihad Supporters Web Communities.

11. Case Study of Jihad on the Web

233

The manual coding of the attributes in a Website takes around 45 minutes of work. After completing the coding scheme for 32 Websites in the collection, we then compared the content of the clusters or hyperlinked communities in the network shown in Figure 11-1. We aggregated data from all Websites belonging to a cluster and displayed the results in snowflake diagrams. Figure 11-3 shows two such diagrams. An interesting observation in these snowflake diagrams is the discrepancy in the “propaganda towards insiders” attribute. Militant groups, in this case Palestinian groups, tend to use the Web for disseminating their ideas in their own communities. They utilize propaganda as an effective tool for influencing youth and possibly recruiting new members. Conversely, the sympathizers try to explain their views to outsiders (Westerners) and try to justify terrorist actions. To ensure that the coding schema we developed for this analysis is reliable, we conducted an experiment to test the reliability of the coding schema. We asked 5 individual coders to perform content analysis on 4 randomly selected Jihad Websites using the coding schema. For each of the 4 Website, the 5 sets of content analysis results were compared and a reliability score (Cronbach’s Alpha) were calculated. The results of the experiment are shown in Table 11-3. Table 11-3. Reliability test results Website: al-ansar.net ezzedeen.net Cronbach’s Alpha:

0.816

0.899

nasrollah.org

jihadunspun. com

Avg

0.759

0.740

0.8035

The high average Cronbach’s Alpha of 0.8035 shows that our coding schema has high reliability.

5.

DISCUSSION AND FUTURE WORK

We have developed an integrated approach to the study of the Jihad terrorism Web Infrastructure. Hyperlinked communities’ analysis brings an overall view of the terror Web infrastructure. Visualizing hyperlinked communities facilitates the analysis of Web infrastructures and paves the way for more refined microscopic content analysis of the Websites. We then conducted a systematic content analysis of the Websites and compared the content of various clusters. As part of our future work, we envisage implementing feature extraction algorithms for automatically detecting attributes in Webpages. We believe that our methodology can be an effective

234

Chapter 11. Chen et al.

tool for analyzing Jihad terrorism on the Web. Moreover, it can be easily extended to analyze other Web contents.

REFERENCES [1] K. Albertsen, “The Paradigma Web Harvesting Environment,” 3rd ECDL Workshop on Web Archives, Trondheim, Norway, August 2003. [2] A. Anderson, “Risk, Terrorism, and the Internet,” Knowledge, Technology & Policy, 16:2, 24-33, Summer 2003. [3] J. Arquilla, D.F. Ronfeldt, Advent of Netwar, Rand Report, 1996. http://www.rand.org/ [4] C. L. Borgman, J. Furner, “Scholarly Communication and Bibliometrics,” Annual Review of Information Science and Technology, ed. B. Cronin. Information Today, Inc, 2002. [5] G. R. Bunt, Islam In The Digital Age E-Jihad, Online Fatwas and Cyber Islamic Environments, Pluto Press, London, 2003. [6] K. M. Carley, J. Reminga and N. Kamneva, “Destabilizing Terrorist Networks,” NAACSOS Conference Proceedings, Pittsburgh, PA, 2003. [7] Y. Carmon, “Assessing Islamist Web Site Reports Of Imminent Terror Attacks In The U.S.,” MEMRI Inquiry & Analysis Series #156, 2003. [8] C. C. Demchak, C. Friis, T. M. La Porte “Webbing Governance: National Differences in Constructing the Face of Public Organizations,” Handbook of Public Information Systems, G. David Garson, ed., New York: Marcel Dekker Publishers, 2000. [9] W. Elison, “Netwar: Studying Rebels on the Internet,” The Social Studies, 91:127-131 May/June 2000. [10] D. Gibson, J. Kleinberg, P. Raghavan, “Inferring Web Communities from Link Topology,” Proceedings of the 9th ACM Conference on Hypertext and Hypermedia, ACM, 1998. [11] Institute for Security Technology Studies, “Examining the Cyber Capabilities of Islamic Terrorist Groups.” Report, ISTS, 2004. http://www.ists.dartmouth.edu/ [12] B.M. Jenkins, “World Becomes the Hostage of Media-Savvy Terrorists: Commentary,” USA Today. August 22, 2004. http://www.rand.org/ [13] R. Kay, “Web Harvesting”, Computerworld, June 21, 2004 http://www.computerworld.com. [14] A.R. Kenney, N.Y. McGovern, P. Botticelli, R. Entlich, C. Lagoze, & S. Payette, “Preservation Risk Management for Web Resources: Virtual Remote Control in Cornell’s Project Prism,” D-Lib Magazine, 8:1, 2002. [15] E. O. F. Reid, “Identifying a Company’s Non-Customer Online Communities: a Prototypology,” Proceedings of the 36th Hawaii International Conference on System Sciences, 2003. [16] B. Reilly, G. Tuchel, J. Simon, C. Palaima, K. Norsworthy, Leslie Myrick, “Political Communications Web Archiving: Addressing Typology and Timing for Selection, Preservation and Access,” 3rd ECDL Workshop on Web Archives, Trondheim, Norway, August 2003. [17] Research Community. PRISM. The Project for the Research of Islamist Movements. http://www.e-prism.org. MEMRI: Jihad and Terrorism Studies Project. The Middle East Research Institute (MEMRI). http://www.memri.org/jihad.html/ SITE Institute, http://www.siteinstitute.org/mission.html. [18] S.M. Schneider, K. Foot, M. Kimpton, & G. Jones, “Building thematic web collections:

11. Case Study of Jihad on the Web

[19]

[20] [21] [22]

235

challenges and experiences from the September 11 Web Archive and the Election 2002 Web Archive,” 3rd ECDL Workshop on Web Archives, Trondheim, Norway, August 2003. S. Tekwani, “Cyberterrorism: Threat and Response,” Institute of Defence and Strategic Studies, Workshop on the New Dimensions of Terrorism, 21-22, Singapore, March 2002. The 9/11 commission report: http://www.gpoaccess.gov/911/ Y. Tsfati, G. Weimann, “www.terrorism.com: Terror on the Internet,” Studies in Conflict & Terrorism, 25:317-332, 2002. G. Weimann, “www.terrorism.net: How Modern Terrorism Uses the Internet,” Special Report 116, U.S. Institute of Peace, 2004. http://usip.org/pubs/

SUGGESTED READINGS · W. Elison, “Netwar: Studying Rebels on the Internet,” The Social Studies, 91:127-131 May/June 2000. · J. Arquilla, D.F. Ronfeldt, Advent of Netwar, Rand Report, 1996. http://www.rand.org/ · S.M. Schneider, K. Foot, M. Kimpton, & G. Jones, “Building thematic web collections: challenges and experiences from the September 11 Web Archive and the Election 2002 Web Archive,” 3rd ECDL Workshop on Web Archives, Trondheim, Norway, August 2003.

ONLINE RESOURCES · Terrorism Knowledge Base. Memorial Institute for the Prevention of Terrorism (MIPT). http://www.tkb.org. · G. Weimann, “www.terrorism.net: How Modern Terrorism Uses the Internet,” Special Report 116, U.S. Institute of Peace, 2004. http://usip.org/pubs/Questions

DISCUSSION QUESTIONS 1. How can analysts, researchers, and counterterrorism specialist use the social network maps of terrorist and extremist groups’ online communities? 2. What do you think is the nature of the relationship between Hizb-utTahrir and Al-Qaeda? 3. How can the different organizations that collect and analysis extremist groups’ Websites collaborate and design a comprehensive database of groups’ digital resources? What policies, incentives, and funding are needed?

12 STUDYING GLOBAL EXTREMIST ORGANIZATIONS’ INTERNET PRESENCE USING THE DARK WEB ATTRIBUTE SYSTEM A Three Region Comparison Study Jialun Qin1, Yilu Zhou2, Edna Reid3, and Hsinchun Chen4

1

Department of Management, University of Massachusetts-Lowell, Lowell, Massachusetts, U.S.A. ( [email protected]); 2Information Systems and Technology Management, George Washington University, Washington, D.C., U.S.A.([email protected]); 3Department of Library Science, Clarion University, Clarion, Pennsylvania, U.S.A. ([email protected]); 4 Department of Management Information Systems, The University of Arizona, Tucson, Arizona, U.S.A. ([email protected])

CHAPTER OVERVIEW Nowadays, global extremist organizations are heavily utilizing Internet technologies to increase their abilities to influence the world. Studying those global extremist organizations’ Internet presence would allow us to better understand extremist organizations’ technical sophistication and their propaganda plans. However, due to the lack of efficient automatic methodologies, few previous researches have attempted to study the extremist organizations’ online presence on a global scale. In this work, we explore an integrated approach for collecting and analyzing extremist online presence. We employed automatic Web crawling techniques to build a comprehensive extremist Web collection which contains around 1.7 million multimedia Web documents. We then used a systematic content analysis tool called the Dark Web Attribute System to study these extremist organizations’ Internet usage from three perspectives: technical sophistication, content richness, and Web interactivity. We also conducted statistical analysis to cross-compare the technical sophistication and effectiveness of Web sites created by extremist groups from different regions. Our analysis results showed that all extremist organizations covered in this study demonstrated high level of technical sophistication in their Web presence but extremist organizations from different regions have different patterns in their Internet technology deployment and online content delivery. Our analysis results would help domain experts deepen their understanding on the global extremism movements and make better counterextremism measures on the Internet.

237

Chapter 12. Qin, et al.

238

1.

INTRODUCTION

Global extremist organizations, ranging from U.S. domestic racist and militia groups to Latin American guerrilla groups and Islamic military groups, have created thousands of Web sites that support psychological warfare, fundraising, recruitment, and distribution of propaganda materials. From those Web sites, supporters can download multimedia training materials, buy games, T-shirts, and music CDs, and access forums and chat services such as PalTalk (Bowers, 2004; Muriel, 2004; Weimann, 2004). Such Web sites are technically supported by those who are Internet Savvy to provide sophisticated propaganda images and videos via proxy servers to mask ownerships (Armstrong & Forde, 2003). As posited by Jenkins (2004), through operating their own Web sites and online forums, extremists have effectively created their sophisticated “terror news network.” Studying the sophistication of global extremist organizations’ Web presence would allow us to better understand extremist organizations’ technical sophistication, their access to information technology related resources, and their propaganda plans. However, due to the covert nature of the Dark Web and the lack of efficient automatic methodologies to monitor and analyze large amount of Web contents, few previous research have attempted to study the extremist organizations’ Web sites on a global scale. Scope of existing Dark Web studies was often limited by the low efficiency of manual analysis approaches. Many basic questions about global Dark Web development remain unanswered. For example, do different organizations have different level of sophistications in terms of their Internet usage? How effective have they been using the Internet technologies in terms of supporting communications and propaganda activities? In order to gain a more comprehensive understanding of the global Dark Web development, in this work, we explore an integrated approach for collecting and monitoring Dark Web contents. We employed automatic Web crawling techniques to build a comprehensive Dark Web collection which covers Web sites created by more than 200 domestic and international extremist organizations. We then applied a systematic content analysis methodology called the Dark Web Attribute System (Qin et al., forthcoming) to enable quantitative assessment of the technical sophistication and effectiveness of these extremist organizations’ Internet usage. We already tested the DWAS in a study of the major Middle Eastern extremist organizations’ Internet usage (Qin et al., forthcoming). The results demonstrated the effectiveness of the DWAS in studying organizations’ Internet usage. Furthermore, the high level of automation in the DWAS leads to high efficiency, making the analysis of very large Web collection possible.

12. Studying Global Extremist Organizations’ Internet Presence

239

The rest of this paper is organized as follows. In Section 2, we briefly review previous works on extremists’ use of the Web. In Section 3, we present our research questions and the proposed methodologies to study those questions. In Section 4, we describe the findings obtained from a case study of the analysis of technical sophistication, content richness, and Web interactivity features of major extremist organizations from three regions: North America, Latin American, and Middle Eastern countries. In the last section, we provide conclusions and discuss the future directions of this research.

2.

LITERATURE REVIEW

2.1

Extremism on the Internet

Previous research showed that extremists mainly utilize the Internet to enhance their information operations surrounding propaganda, communication, and psychological warfare (Thomas, 2003; Denning, 2004; Weimann, 2004). According to Weimann (2004), almost all major extremist organizations in the world have established their presence on the Internet. Islamic militant organizations, such as Al Quaeda, Hamas, Hezbollah, etc., have been intensively utilizing the Internet to disseminate their antiWestern, anti-Israel propaganda, provide training materials to their supporters, plan their operations, and raise funds by selling goods through their Web sites (9/11 Commission Report, 2004; Waldman, 2004). The level of technical sophistication of the Islamic extremist organizations’ Web sites has been increasing according to Katz, who monitors Islamic fundamentalist Internet activities (Internet Haganah, 2005; SITE, 2004). Latin American guerrilla groups are also among the Internet-savvy extremist organizations. Mexico's Zapatista guerrillas have been rallying support online since their 1994 uprising. Their Web site (http://www.ezln.org/) has long been a Lycos Web Points’ (http://point.lycos.com/) top 5% WWW sites and serves a mouthpiece for the organization. Other major Latin American extremist groups such as the Revolutionary Armed Forces of Colombia (FARC) and the “Shining Path” in Peru also host their own Web sites containing scrolls of propaganda materials. U.S. domestic extremist and hate groups have also exploited Internet technology to enhance their operations and were among the early adopters of computer bulletin boards that eventually evolved into the Internet (Gerstenfeld et al., 2002). Stormfront.org, a neo-Nazi’s Website set up in 1995, is considered the first major domestic “hate site” on the World Wide

Chapter 12. Qin, et al.

240

Web because of its depth of content and its presentation style which represented a new period for online right-wing extremism (Whine, 1997). The neo-Nazis groups share a hatred for Jews and other minorities, and a love for Adolf Hitler and Nazi Germany. A social network analysis of extremist Websites revealed that the Stormfornt.org served as a central node that occupied a prominent position within the White Supremacist network (Burris et al., 2000). Extremist groups have sought to replicate or supplement the communication, fundraising, propaganda, recruitment, and training functions on the Web by building web sites with massive and dynamic online libraries of speeches, training manuals, and multimedia resources that are hyperlinked to other sites that share similar beliefs (Coll & Glasser, 2005; Weimann, 2004). The Web sites are designed to communicate with diverse global audiences of members, sympathizers, media, enemies, and the public (Weimann, 2004). Since extremist organizations are active on the Internet, studying their Web presence may help us develop a better understanding of the extremists themselves.

2.2

Existing Dark Web Studies and Research Gaps

In recent years, there have been studies on how extremist organizations use the Web to facilitate their activities (Zhou et al., 2005; Chen, et. al., 2004; ISTS, 2004; Thomas, 2003; Tsfati & Weimann, 2002; SITE, 2004; Weimann, 2004). For example, since the late 1990s, several organizations, such as SITE Institute, the Anti-Terrorism Coalition, and the Middle East Media Research Institute (MEMRI), started to monitor contents from extremist Web sites for research and intelligence purposes. However, due to the limitations of manual analysis approaches employed in those studies, the scopes of those studies have been limited to some selected groups. Table 2 lists some of the organizations that capture and analyze extremists’ Web sites grouped into three functional categories: archive, research center, and vigilante community. Table 12-1. Organizations that Capture and Analyze Extremists’ Web Sites Organization Description Access 1. Internet Archive (IA)

2. Anti-terrorism Coalition (ATC) 3. Artificial Intelligence (AI)

Archive 1996-. Collect open access HTML pages (every 2 mths.) Research Centers 2003-. Jihad Watch. Has 448 extremist Web sites & forums 2003-. Spidering (every 2

Via http://www.archive.org

Via http://www.atcoalition.net Via testbed portal called

12. Studying Global Extremist Organizations’ Internet Presence Organization Lab, University of Arizona

4. MEMRI 5. Site Institute

6. Weimann (Univ. Haifa, Israel)

7. Internet Haganah

Description mos.) to collect extremist Web sites. Has 1000s Web sites: U.S. Domestic, Latin America, & Middle Eastern Web sites 2003 -. Jihad & Terrorism Studies Project. 2003 -. Capture Web sites every 24 hrs. Extensive collection of 1000s of files. 1998 -. Capture Web sites daily. Extensive collection of 1000s of files. Vigilante Community 2001-. Confronting the Global Jihad Project. Has 100s links to Web sites.

241

Access Dark Web Portal

Access reports via http://www.memri.org Access reports & fee-based intelligence services http://siteinstitute.org Closed collection

Provides snapshots of terrorist Web sites http://haganah.us

Except for the Artificial Intelligence (AI) Lab, none of the enumerated organizations seem to use automated methodologies for both collection building and analysis of extremist Web sites. Due to the low efficiency of the manual collection and analysis approaches, comprehensiveness of their analyses has been limited. In order to gain deeper understanding on global extremists’ use of the Internet, we believe it is important to analyze the technical sophistication, content richness, and Web interactivity of extremist Web sites on a global scale.

2.3

Dark Web Collection Building

The first step towards studying the extremist Web presence is to capture extremist Web sites and store them in a repository for further analysis. Previous studies have suggested three types of approaches to collecting Web contents in specific domains: manual approach, automatic approach, and semiautomatic approach. In order to build the September 11 and Election 2002 Web Archives (Schneider et al., 2003), the Library of Congress manually collected relevant seed URLs and downloaded their contents. The limitation of such a manual approach is that it is time-consuming and inefficient. To archive Norwegian legal deposit documents on the Web, Albertsen (2003) used an automatic approach in the “Paradigma” project. They employed a focused Web crawler (Kleinberg et al., 1999), an automatic program that discovers and downloads Web sites in particular domains by following Web links. The automatic approach is more efficient

Chapter 12. Qin, et al.

242

than the manual approach; however, due to the limitations of current focused crawling techniques, automatic approaches often introduce noise (off-topic Web pages) into the collection. In order to ensure both quality and efficiency in collecting Dark Web contents, we proposed a semi-automatic Dark Web crawling approach which combined the accuracy of human experts and the efficiency of automatic Web crawlers (Zhou et al., 2004). The semi-automatic approach contains four major steps. First, a list of extremist organizations is identified from authoritative sources such as U.S. State Department report, FBI report, and UN security counsel. Then, URLs of Web sites created by these organizations are identified either directly from the same authoritative sources or by searching the Internet using those organizations’ information (group name, leader names, jargons, etc.) as queries. The identified URLs form the initial seed URL set and this set are then further expanded through out-link and in-link expansion approaches. Last, the identified extremist Web sites are automatically downloaded using an intelligent Web crawler. Using this approach, we successfully created a comprehensive Dark Web testbed containing more than 100 Web sites created by extremists. We believe that this semiautomatic approach is most suitable for creating the comprehensive Dark Web collection for this study.

2.4

Dark Web Content Analysis

In order to reach an understanding of the various facets of extremists’ Web usage and communications, a systematic analysis of the Web sites’ content is required. Researchers in the extremism domain have used observation and content analysis to analyze Web site data. In Bunt’s (2003) overview of Jihadi movements’ presence on the Web, he described the reaction of the global Muslim community to the content of extremist Web sites. His assessment of the influence such content had on Muslims and Westerners was based on a qualitative analysis of message contents extracted from Taliban and Al-Qaeda Web sites. Tsfati and Weimann (2002) conducted a content analysis of the characteristics of extremist groups’ communications. They said that the small size of their collection and the descriptive nature of their research questions made a quantitative analysis infeasible. In order to enable quantitative study, we proposed a systematic Dark Web content analysis approach called the Dark Web Attribute System (DWAS). The DWAS extracts the appearances of specific attributes from extremist Web sites and assigns each Web site three scores to indicate their levels of technical sophistication, content richness, and Web interactivity. The attributes used in DWAS were identified from literatures in e-

12. Studying Global Extremist Organizations’ Internet Presence

243

Commerce (Palmer & David, 1998), e-Government (Demchak & Friis, 2004), and e-Education (Cho, 2004) domains. Unlike most manual-based, qualitative content analysis approaches used in previous Dark Web studies, the DWAS employs programs to automatically identify the appearances of attributes and generate quantitative results. We successfully applied the DWAS to study the technical sophistication and effectiveness of Middle Eastern extremist organizations’ Internet usage. We believe that the DWAS is also an effective tool to study the extremist’s tactical use of the Internet on a global scale.

3.

STUDYING GLOBAL EXTREMIST ORGANIZATIONS’ INTERNET USAGE: A THREE-REGION EMPIRICAL STUDY

Studying the Dark Web helps us deepen our understandings on the global extremism movements. However, traditional manual based Web analysis approaches were not efficient enough to conduct comprehensive Dark Web studies on a global scale. To address this research gap, we propose a large scale empirical study on the technical sophistication and effectiveness of global extremist organizations’ Internet usage. To ensure the comprehensiveness, our study covers Web sites created by major extremist organizations from three geographical regions across the world: US domestic racist and hate groups, Latin American guerrilla and separatist groups, as well as Middle Eastern Islamic extremist groups. We also conducted crosscompared Web sites of different types of extremist groups to reveal the differences in extremist organizations’ online capabilities and strategies. The research questions postulated in our study are: · What design features and attributes are necessary to build a highly relevant and comprehensive global Dark Web collection for analysis purposes? · For extremist Web sites, what are the levels of technical sophistication, content richness, and interactivity? · What major differences exist between the characteristics of Web sites created by extremists from different regions with different ideologies? To study the research questions, we propose to use the Dark Web analysis methodology proposed in Qin et al. (forthcoming) and expand the scope of the study to a global level. Both the semi-automatic collection build approach and the DWAS have been shown as effective tools in our previous studies on the Middle Eastern extremist organizations’ Web presence (Qin et al., forthcoming).

Chapter 12. Qin, et al.

244

3.1

Dark Web Collection Building

To ensure the quality of our collection, we propose to use a semiautomated approach to collecting Dark Web contents (Zhou et al., 2004). The collection used in this study was built in May 2006. The collection was built in the following 4 steps: 1. Identify extremist groups: We started the collection building process by identifying the groups that are considered by authoritative sources as extremist groups. The sources include government agency reports (e.g., U.S. State Department reports, FBI reports, etc.), authoritative organization reports (e.g., Counter-Terrorism Committee of the UN Security Council, etc.), and studies published by extremism research centers such as the Anti-Terrorism Coalition (ATC), the Middle East Media Research Institute (MEMRI), etc. From those sources, we identified around 200 U.S. domestic groups, and around 400 International groups. Information such as extremist group names, leader names, and extremist jargons are identified from the sources to create a extremism keyword lexicon for use in the next step. 2. Identify extremist group URLs: We manually identified a set of seed extremist group URLs from two sources. First, some extremist URLs were directly identified from the authoritative sources and literatures mentioned above. Second, we identified another set of extremist URLs by querying major search. The initial set of seed URLs was then expanded. The queries were issued in the corresponding extremist groups’ native languages. For example, the queries we used when searching for Middle Eastern groups’ URLs include extremist leaders’ names such as “‫( ”اﻟﺸﯿﺦ اﻟﻤﺠﺎھﺪ ﺑﻦ ﻻدن‬Sheikh Mujahid bin Laden), extremist groups’ names such as “‫“( ”اﯾﺮان ﺧﻠﻖ‬Khalq Iran”), and special words used by extremists such as “‫“( ”ﺣﺮب ﺻﻠﯿﺒﯿﺔ‬Crusader’s War”) and “‫“( ”اﻟﻜﻔﺎر‬Infidels”). 3. Expand extremist URL set through link and forum analysis: After identifying the seed URLs, We extracted out-links and in-links of the seed URLs using an automatic link-analysis programs. The out-links were extracted from the HTML contents of “favorite link” pages under the seed Web sites. The in-links were extracted from Google in-link search service through Google API. We also had language experts who browsed the contents of extremist supporting forums and extract the extremist URLs posted by extremism supporters. The expanded extremist URL set was them manually filtered by domain experts to ensure that irrelevant and bogus Web sites did not make way into our collection. After the filtering, a total of 224 extremist group URLs (92 U.S. domestic group URLs, 53 Latin American group URLs, and 79 Middle Eastern

12. Studying Global Extremist Organizations’ Internet Presence

245

group URLs) were included in our final URL set. 4. Download extremist Web site contents: The multimedia and multilingual contents of the identified extremist Web sites were automatically collected using a Web crawler developed by our group. Our Web crawler was designed to download not only the textual files (e.g., HTML, TXT, PDF, etc.) but also multimedia files (e.g., images, video, audio, etc.) and dynamically generated Web files (e.g., PHP, ASP, JSP, etc.). Moreover, because extremist organizations set up forums within their Web sites whose contents are of special value to research communities, our Web crawler also can automatically log into the forums and download the dynamic forum contents. The automatic Web crawling approach allows us to effectively build Dark Web collections with millions of documents. This would greatly increase the comprehensiveness of our Dark Web study. Following the four steps described above, we built a global Dark Web collection contain around 1.7 million multimedia documents. Table 2 summarizes the detailed file type breakdown of the global Dark Web collection. The textual files make the large category in the Dark Web collection. Textual files include static textual files such as HTML files, PDF files, MS Word documents, as well as dynamic files such as PHP files, ASP files, and JSP files. Interestingly, more than half of the textual files in the Dark Web collection are dynamic files. In particular, dynamic files make up to 78% of all textual files. We conducted a preliminary analysis on the contents of these dynamic files and found that most dynamic files were forum postings. This indicates that online forums play an important role in extremists’ Web usage, especially for Middle Eastern groups. Other than textual files, multimedia files also make a significant presence in the extremist collection which indicates heavy use of multimedia technologies in extremist Web sites. The last two types of files, archive files and non-standard files, made up less than 5% of the collection. Archive files are compressed file packages such .zip files and .rar files. They could be password-protected. Non-standard files are files that cannot be recognized by the Windows operating system. These files may be of special interest of extremism researchers and experts because they could be encrypted information created by extremists. Further analysis is needed to study the contents of these two types of files. Comparing documents created by groups from different regions, we found that the number of Web documents created by the Middle Eastern groups is much larger than those of the U.S. domestic groups and the Latin American groups. This indicates the Middle Eastern extremist organizations are making a more prominent presence on the Web. A more detailed analysis

Chapter 12. Qin, et al.

246

on the technical sophistication and effectiveness of the extremists’ Internet presence will be described in the next section. Table 12-2. Dark Web Collection File Type Breakdown # of Files File Types U.S. Domestic Latin American Textual Files 312408 230977 Static Files 154148 89150 Dynamic Files 158260 141827 Multimedia Files 96738 55618 Image Files 91089 54422 Audio Files 3769 941 Video Files 1880 255 Archive Files 327 852 Non-Standard Files 1355 650 Total 410828 288097

3.2

Middle Eastern 804145 176061 628084 225557 216520 1437 7600 1499 1537 1032738

Dark Web Content Analysis Using the DWAS

We used the DWAS as our content analysis tool to generate quantitative indications of the technical sophistication and effectiveness of global extremists’ use of the Internet. The DWAS contains three sets of attributes: 13 technical sophistication (TS) attributes, five content richness (CR) attributes (an extension of the traditional media richness attributes), and 11 Web interactivity (WI) attributes. Different weights were assigned to each technical sophistication and Web interactivity attribute to indicate their different levels of importance. A list of these attributes is summarized in Tables 3. Table 12-3. Summary of DWAS Attributes and Weights TS Attributes Basic HTML Techniques

Embedded Multimedia

Advanced HTML

Dynamic Web Programming

Use of Lists Use of Tables Use of Frames Use of Forms Use of Background Image Use of Background Music Use of Stream Audio/Video Use of DHTML/SHTML Use of Predefined Script Functions Use of Self-defined Script Functions Use of CGI Use of PHP Use of JSP/ASP

Weights 1 2 2 1.5 1 2 3.5 2.5 2 4.5 2.5 4.5 5.5

12. Studying Global Extremist Organizations’ Internet Presence CR Attributes Hyperlink File/Software Download

# of hyperlinks # of downloadable documents

Image Audio Files Video Files

# of images # of audio files # of video files WI Attributes

247 Scores

Hyperlink File/Software Download Image Audio Files Video Files Weights

One-to-one Level Interactivity Email Feedback Email List Contact Address Feedback Form Guest Book

1.75 2.25 1.25 2.75 1.50 Community Level Interactivity

Private Message Online Forum Chat Room

4.25 4.25 4.75 Transaction Level Interactivity

Online Shop Online Payment Online Application Form

4.00 4.00 4.00

We developed strategies to efficiently and accurately identify the presence of the DWAS attributes from Dark Web sites. The TS and CR attributes are marked by HTML tags in page contents or file extension names in the page URL strings. For example, a URL string ending with “.jsp” indicates that the page utilizes JSP technology. We developed programs to automatically analyze Dark Web page contents and URL strings to extract the presence of the TS and CR attributes. Since there are no clear indications or rules that a program could follow to identify WI attributes from Dark Web contents with a high degree of accuracy, we developed a set of coding scheme to allow human coders to identify their presence in Dark Web sites. Technical sophistication, content richness, and Web interactivity scores are calculated for each Web site in the collection based on the presence of the attributes to indicate how advanced and effective the site is in terms of supporting communications and interactions.

3.3

Experimental Results

Following the DWAS approach, presence of the technical sophistication and media richness attributes was automatically extracted from the collections using programs. Presence of the Web interactivity attributes was extracted from each Web site by language experts based on the coding scheme in DWAS. Because of the time limitation, language experts only

Chapter 12. Qin, et al.

248

examined the top two level Web pages in each Web site. For each Web site in the global Dark Web collection, three scores (technical sophistication, content richness, and Web interactivity) were calculated based on the presence of the attributes and their corresponding weights in DWAS. Statistical analysis was conducted to cross-compare the advancement/effectiveness scores achieved by the Web sites of extremist organizations from the three different regions. 3.3.1

Comparison Results: Technical Sophistication

To learn whether there are differences in extremist organizations’ level of sophistication, we used ANOVA analysis to compare the technical sophistication scores achieved by Web sites of extremist groups from different regions. Figures 12-1.a to 12-1.e show the ANOVA results of different technical sophistication levels.

ANOVA Basic TS (Significance Level at 0.05) F p-Value 3.987669 0.019863**

F crit 3.035794

Figure 12-1.a. Basic HTML Technical Sophistication ANOVA Results

12. Studying Global Extremist Organizations’ Internet Presence

249

Figure 12-1.a shows that, in terms of applying basic HTML techniques, there are significant differences in the levels of technical sophistication between Web sites created by groups from the three regions. More specifically, the confidence interval plot shown in the upper side of Figure 12-1.a shows that U.S. domestic group Web sites and Middle Eastern group Web sites achieved similar level of basic technical sophistication and they are both significantly better than Latin American group Web sites.

ANOVA Media TS (Significance Level at 0.05) F p-Value 6.23225 0.00233**

F crit 3.036902

Figure 12-1.b. Embedded Media Technical Sophistication ANOVA Results

In terms of embedded media usage, as shown in Figure 12-1.b, the ANOVA result shows that there are significant differences (p-Value = 0.00233) in the levels of technical sophistication between Web sites created by groups from the three regions. The confidence interval plot further shows that the differences in embedded media usage between Web sites created by groups of the three regions follow the same pattern as the differences in basic HTML techniques: while U.S. groups and Middle Eastern groups are

Chapter 12. Qin, et al.

250

comparable; both of them are significantly better than Latin American groups.

ANOVA Advanced TS (Significance Level at 0.05) F p-Value 16.10481 2.97E-07**

F crit 3.036902

Figure 12-1.c. Advanced Technical Sophistication ANOVA Results

For advanced HTML technique usage, as shown in Figure 12-1.c, similar patterns were observed again. U.S. domestic group Web sites and Middle Eastern group Web sites performed comparably and they both significantly (p-Value < 0.00001) outperformed the Latin American Web sites. For the use of dynamic Web programming languages such as PHP and JSP，a different pattern was observed. As shown in Figure 12-1.d, Middle Eastern groups are the most advanced ones in terms of applying dynamic Web programming techniques in their Web sites. They are significantly

12. Studying Global Extremist Organizations’ Internet Presence

251

better (p-Value = 0.012885) than both U.S. domestic groups and Latin American groups. While the U.S. domestic groups performed better than the Latin American groups, the difference is not significant.

ANOVA Dynamic TS (Significance Level at 0.05) F p-Value 4.438946 0.012885**

F crit 3.036902

Figure 12-1.d. Dynamic Web Programming Technical Sophistication ANOVA Results

When taking all four attributes of technical sophistication into consideration, as shown in Figure 12-1.e, Middle Easter groups are the best among all extremist groups across the world, although the difference between them and U.S. domestic groups is not significant. Latin American groups lag behind both Middle Eastern groups and U.S. domestic groups. The difference between Latin American groups and groups from the other two regions is significant (p-Value = 0.0000107).

252

Chapter 12. Qin, et al.

ANOVA Overall TS (Significance Level at 0.05) F p-Value F crit 12.06542 1.07E-05** 3.036902 Figure 12-1.e. Overall Technical Sophistication ANOVA Results

Technical sophistication of Web sites run by extremist organizations is a good indication of the level of IT expertise the organizations have as well as the level of investment the organizations have put on building their Internet presence. Considering the United State is the most IT savvy country in the world where Internet technologies and services are easily and cheaply available, it is not surprising to see U.S. domestic extremist organizations have achieved high level of technical sophistication in utilizing the Internet infrastructure. The Middle Eastern groups, on the other hand, are mostly rooted in countries where Internet technologies and infrastructure are much less developed. Nevertheless, they achieved a technical sophistication level that is even higher than that of the U.S. domestic groups. This indicates that the Internet has become a very important part of the Middle Easter extremist organizations’ agenda and they have made the efforts to take advantages of the latest Internet technologies. The Latin American extremist groups seem to have a different attitude towards Internet. Their Web sites are significantly less sophisticated than groups from the other two regions, which indicates that they had less investment on Internet technologies. Furthermore, the Middle Eastern groups are significant more advanced in terms of utilizing

12. Studying Global Extremist Organizations’ Internet Presence

253

dynamic Web programming techniques in their Web site than groups from the other two regions. Based on our preliminary studies, in extremist Web sites, dynamic Web programming techniques are usually used to support communication functionalities such as online forums and chat rooms. This high level usage of dynamic Web programming techniques in the Middle Easter group Web sites calls for further investigations. 3.3.2

Comparison Results: Content Richness

Content richness is an important criterion to measure the effectiveness of extremists’ online propaganda plans. The richer the contents are on their Web sites, the more information can the extremist groups convey to their supporters, thus achieving better mobilization goals. To study the propaganda plans of different extremist groups, we conducted ANOVA analysis to compare the content richness of their Web sites.

ANOVA # of Links CR (Significance Level is at 0.05) F p-Value 3.037265 0.048818**

F crit 3.013056

Figure 12-2.a. Number of Links ANOVA Results

Chapter 12. Qin, et al.

254

Figure 2.a shows the comparison results of average number of hyperlinks per Web site. As we can see from the confidence interval plot, the Middle Eastern groups Web sites contain significantly more hyperlinks than Web sites of the other two categories of groups (p-Value = 0.048818). Having more hyperlinks in their Web sites, the Middle Eastern groups provide their supporters with more opportunities to locate Web documents that they really want. Moreover, more hyperlinks between different groups Websites indicates that stronger real world relationships exist between those Middle Eastern extremist organizations.

ANOVA # of Downloads (Significance Level is at 0.05) F p-Value 0.226105 0.797729

F crit 3.016694

Figure 12-2.b. Number of Downloads ANOVA Results

Another important content richness attribute is the number of downloadable documents on a Web site. Downloadable documents include textual files (e.g., PDF files, MS Word Files, etc.) and archive files (e.g., ZIP files, RAR files, etc.). Previous studies (Bowers, 2004; Muriel, 2004;

12. Studying Global Extremist Organizations’ Internet Presence

255

Weimann, 2004; SITE, 2004) showed that providing downloadable documents on Web site has become a major means for extremists to disseminate their propaganda materials. From Figure 2.b, we can see that extremist groups from all three major regions provide similar amount of downloadable documents on their Web sites. Multimedia documents, including images, audio files, and video files, are the most important vehicles to convey information to Web users. They are more attractive and tend to leave a stronger impression on people than pure textual contents. As shown in Figures 2.c-2.e, the Middle Easter groups posted significantly (p-Value = 0.001219) more images and video files on their Web sites than the U.S. domestic and Latin American groups. The U.S. Domestic groups posted more audio files than the Middle Eastern and Latin American groups; but the difference is not significant (p-Value = 0.135728).

ANOVA # of Images (Significance Level is at 0.05) F p-Value 4.218931 0.015325**

F crit 3.016602

Figure 12-2.c. Number of Images ANOVA Results

Chapter 12. Qin, et al.

256

ANOVA # of Audio Files (Significance Level is at 0.05) F p-Value 2.00641 0.135728

F crit 3.016694

Figure 12-2.d. Number of Audio Files ANOVA Results

12. Studying Global Extremist Organizations’ Internet Presence

ANOVA # of Video Files (Significance Level is at 0.05) F p-Value 6.816345 0.001219**

257

F crit 3.016893

Figure 12-2.e. Number of audio files ANOVA results

The large amount of multimedia content posted on the Middle Eastern groups Web sites is an indication that the Middle Eastern groups have very active propaganda strategies. Moreover, hosting large volume of multimedia contents usually requires Web servers with high stability and bandwidth. The Middle Eastern extremist groups succeeded in building such a stable online infrastructure to support their sophisticated online propaganda campaigns. 3.3.3

Comparison Results: Web Interactivity

Supporting the communications between their members and their supporters is one of the major goals of extremists’ Internet exploitation. We conducted ANOVA analysis to compare the effectiveness of extremist groups’ communications through their Web sites.

Chapter 12. Qin, et al.

258

ANOVA 1-to-1 Interactivity (Significance Level is at 0.05) F p-Value 9.027465 0.000181**

F crit 3.044505

Figure 12-3.a. 1-to-1 level interactivity ANOVA results

As shown in Figure 12-3.a, in terms of one-to-one level interactivity, both the U.S. domestic groups and Latin American groups performed significantly (p-Value = 0.000181) better than the Middle Eastern groups. One possible explanation for the low one-to-one interactivity support from the Middle Easter groups is that the Middle Eastern extremist groups are more radical and covert than the U.S. domestic and Latin American groups. Many of the Middle Eastern groups are currently under military suppression from the West. In many cases, they could not give out their address and other contact information to the public. At the community level, as shown in Figure 12-3.b, the U.S. domestic groups and the Middle Eastern groups both performed better than the Latin American groups. The difference between the U.S. domestic and Latin American groups is significant (p-Value = 0.044895). The U.S. domestic extremist groups are among the earliest adopters of Internet forums.

12. Studying Global Extremist Organizations’ Internet Presence

259

ANOVA Community Interactivity (Significance Level is at 0.05) F p-Value F crit 3.155795 0.044895** 3.044505 Figure 12-3.b. Community level interactivity ANOVA results

It is not surprising to see that they are still heavily utilizing Internet tools such as forums and chat rooms to support their communication with their supporters. The Middle Eastern groups are the newer adopters of such Internet-based communication tools, but they are also very active in terms of hosting and maintaining online forums and bulletin boards. Some of the Middle Eastern extremist group forums have grown very large in scale. For example, www.shawati.com has 31,894 registered forum members and 418,196 posts; www.kuwaitchat.net has 11,531 registered members and 624,694 posts. Not all of the forum members are extremism or extremists. Many of them are just supporters or sympathizers. Members of these large forums participate in daily discussions, express their support of the extremist groups, and reinforce each other’s beliefs in the extremist groups’ courses. They sometimes can get messages directly from active members of extremist groups. For example, messages from the Iraqi extremist leader, Abu Mus’ab Zarqawi can often be found in online forum www.islamic-f.net. These

260

Chapter 12. Qin, et al.

dynamic forums provide snapshots of extremist groups’ activities, communications, ideologies, relationships, and evolutionary developments.

ANOVA Transaction Interactivity (Significance Level is at 0.05) F p-Value F crit 15.69915 5.01051E-07** 3.044505 Figure 12-3.c. Transaction level interactivity ANOVA results

The transaction level interactivity is the most advanced level of interactivity that Web sites can support. At this level, as shown in Figure 123.c, the U.S. domestic groups significantly outperformed both the Latin American and Middle Eastern groups. Supporting transaction level interactivity requires high level of technical sophistication which the Latin American groups did not demonstrate based on our TS comparison results. That is one possible explanation for Latin American groups’ low performance. On the other hand, transaction level interactivities usually involve the transfer of funds online. In order to perform such tasks, one is often required to provide their identity information (bank account member,

12. Studying Global Extremist Organizations’ Internet Presence

261

billing address, contact information, etc.) to online service providers. It is difficult for the Middle Eastern groups to meet these requirements because they have to remain covert, which is a possible explanation for their low performance in supporting transaction level interactivity.

ANOVA Overall Interactivity (Significance Level is at 0.05) F p-Value 15.7745 4.7E-07**

F crit 3.044505

Figure 12-3.d. Overall Web interactivity ANOVA results

When taking all three levels of Web interactivity into consideration, as shown in Figure 12-3.d, the U.S. domestic groups performed significantly better (p-Value < 0.0001) than both the Latin American and Middle Eastern groups.

4.

CONCLUSIONS AND FUTURE DIRECTIONS In this paper, we discussed a large scale empirical study to explore the

262

Chapter 12. Qin, et al.

application of automatic Web crawling techniques and the Dark Web Attribute System in studying global extremist organizations’ Internet presence. Using a semi-automatic crawling approach, we collected more than 1.7 million multimedia Web documents from around 224 Web sites created by major extremist organizations rooted in North America, Latin America, and Middle Eastern countries. We then used the Dark Web Attribute System to study these extremist organizations’ Internet usage from three perspectives: technical sophistication, content richness, and Web interactivity. In order to gain a deeper understanding on different extremist organizations’ IT capabilities, we also conducted statistical analysis to crosscompare the technical sophistication and effectiveness of Web sites created by extremist groups from different regions. Our analysis results showed that, among groups from all three regions, the Middle Eastern extremist organizations are the most active exploiters of the Internet. They demonstrated the highest level of technical sophistication and provided the richest multimedia contents in their Web sites. However, due to their covert nature, they did not perform as well as the U.S. domestic extremist organizations in terms of supporting communications using Internet technologies. Because the U.S. domestic groups take full advantages of Internet technologies such as forums, chat rooms, and e-Commerce transactions, to facilitate their communication and interaction with their supporters. The Latin American groups, on the other hand, lagged behind groups from the other two regions in terms of exploiting the Internet. Their Web sites are not as sophisticated as those of their U.S. and Middle Eastern counterparts. They were also not as effective in terms of utilizing the Internet to support their communications. The contribution of this study is twofold. First, this study further explored the high effectiveness and efficiency of automatic Web mining techniques in Dark Web studies. It expanded the scope of our previous Dark Web content analysis (Qin et al., forthcoming) and pushed the comprehensiveness of Dark Web studies to a new level. Second, the results of our empirical study help domain experts deepen their understanding on the global extremism movements and make better counter-extremism measures on the Internet. We have several future research directions to pursue. First, we will further improve the Dark Web Attributes System by incorporating more accurate attributes into the system. We will also collaborate with more Internet technology experts to further fine tune the weights associated with the DWAS attributes. Second, we will explore more effective Web crawling techniques to further expand the coverage of our Dark Web study. Third, we will collaborate with more extremism domain experts to better interpret our findings. Last but not least, we will explore the application of the proposed

12. Studying Global Extremist Organizations’ Internet Presence

263

automatic Web crawling and content analysis tools in other domains such as business intelligence and e-Government.

REFERENCES Anderson, A., “Risk, Terrorism, and the Internet,” Knowledge, Technology & Policy, 16:2, 24-33, Summer 2003. Armstrong, H. L. and Forde, P. J., “Internet Anonymity Practices in Computer Crime,” Information Management & Computer Security, 11(5), pp. 209-215, 2003. Arquilla, J. and Ronfeldt, D., “Cyber War Is Coming!” Comparative Strategy, 12(2), 1993. Becker, A. “Technology and Terror: the New Modus Operandi,” Frontline, 2004, available at http://www.pbs.org/wgbh/pages/frontline/shows/front/special/tech.html Bowers, F., “Terrorists spread their messages online,” Christian Science Monitor, July 28, 2004, available at http://www.csmonitor.com/2004/0728/p03s01-usgn.htm. Chakrabarti, S., van den Berg, M. and Dom, B., “Focused crawling: a new approach to topicspecific Web resource discovery,” in Proc. of the 8th International World Wide Web Conference, Toronto, Canada, 1999. Chen, H., Qin, J., Reid, E., Chung, W., Zhou, Y., Xi, W., Lai, G., Bonillas, A. A. and Sageman, M., “The Dark Web Portal: Collecting and Analyzing the Presence of Domestic and International Terrorist Groups on the Web,” In Proc. of International IEEE Conference on Intelligent Transportation Systems, 2004. Chou, C., “Interactivity and interactive functions in web-based learning systems: a technical framework for designers.” British Journal of Educational Technology, 34(3), pp. 265-279, 2003. Coll, S. and Glasser, S. B., “Terrorists Turn to the Web as Base of Operations,” Washington Post, Aug 7, 2005. Demchak, C., Friis, C., and La Porte, T. M., “Webbing Governance: National Differences in Constructing the Face of Public Organizations,” Handbook of Public Information Systems. G. D. Garson. NYC, Marcel Dekker, 2001. Denning, D. E., “Information Operations and Terrorism,” Journal of Information Warfare (draft), 2004, available at http://www.jinfowar.com. Elison, W., “Netwar: Studying Rebels on the Internet,” The Social Studies, 91, pp. 127-131, 2000. FBIS, “Arab Afghans Said to Launch Worldwide Terrorist War,” Paris al-Watan al-’Arabi, December 1, 1995, pp.22-24, FBIS-TOT-96-010-L. Hillman, D. C. A., Willis, D. J., and Gunawardena, C. N., “Learner-interface interaction in distance education: an extension of contemporary models and strategies for practitioners.” The American Journal of Distance Education, 8(2), pp. 30-42, 1994. Hoffman, D. L. and Novak, T. P., “Marketing in hypermedia computer-mediated environments: Conceptual foundation.” Journal of Marketing, 60(3), pp. 50-68, 1996. ISTS, “Examining the Cyber Capabilities of Islamic Terrorist Groups”. Report, Institute for Security Technology Studies, 2004. http://www.ists.dartmouth.edu/ Internet Haganah, Internet Haganah report, 2005, available at http://en.wikipedia.org/wiki/Internet_Haganah. Jenkins, B. M., International Terrorism, Crescent Publication, Los Angeles, 1975. Jenkins, B. M., “World Becomes the Hostage of Media-Savvy Terrorists: Commentary”, USA Today, August 22, 2004. http://www.rand.org/ Delio, M., “Al Qaeda Websites Refuses to Die,” Wired, April 7, 2003, available at: http://

264

Chapter 12. Qin, et al.

www.wired.com/news/infostructure/0,1377,583562,00.html?tw=wn_story_page_next1. Jackson, Brian J. Technology Acquisition by Terrorist Groups: Threat Assessment Informed by Lessons from Private Sector Technology Adoption. Studies in Conflict & Terrorism, vol. 24, p183-213. 2001 Jesdanun, A., “WWW: Terror’s Channel of Choice,” CBS News, June 20, 2004. Kelley, J., “Terror Groups Hide Behind Encryption,” USA Today, Feb 5, 2001, available at http://www.usatoday.com/tech/news/2001-02-05-binladen.htm Lawrence, S. and Giles, C. L., “Searching the World Wide Web.” Science, 280(5360), 1998, pp. 98. Lawrence, S. and Giles, C. L. “Accessibility of information on the Web.” Nature, 400, 1999, pp. 107-109. Lyman, P. and Varian, H.R., “How Much Information.” published by the UC Berkeley School of Information Management and Systems, 2000. McCallum, A., Nigamm, K., Rennie, J., and Seymore, K., “Building Domain-Specific Search Engines with Machine Learning Techniques” Proc. AAAI-99 Spring Symposium on Intelligent Agents in Cyberspace, 1999 Michalewicz, Z., Genetic algorithms + data structures = evolution programs. Berlin/Heidelberg: Springer-Verlag, 1992. Muriel, D., “Terror Moves to the Virtual World,” CNN News, April 8, 2004, available at http://edition.cnn.com/2004/TECH/04/08/internet.terror/. Nunnelly, J., Psychometric theory. McGraw Hill, New York, 1978. Palmer, J. W. and Griffith, D. A., “An Emerging Model of Web Site Design for Marketing,” Communications of the ACM, 41(3), pp. 45-51, 1998. Preece, J., Online Communities: Designing Usability, Supporting Socialability, 2000, New York City, Wiley. Reid, E., Qin, J., Chung, W., Xu, J., Zhou, Y., Schumaker, R., Sageman, M., and Chen H., “Terrorism Knowledge Discovery Project: a Knowledge Discovery Approach to Addressing the Threats of Terrorism” in Proc. of 2nd Symposium on Intelligence and Security Informatics, ISI 2004, , Tucson, Arizona, 2004. Rusay, C., “User-centered design for government portals,” Digital Web Magazine, Jan 16, 2003, available at http://www.digital-web.com/articles/user_centered_design_for_large_ government_portals/ Schneider, S. M., Foot, K., Kimpton, M., and Jones, G., “Building thematic web collections: challenges and experiences from the September 11 Web Archive and the Election 2002 Web Archive,” in Proc. of the 3rd ECDL Workshop on Web Archives, Trondheim, Norway, August 2003. Tekwani, S., “Cyberterrorism: Threat and Response,” Institute of Defence and Strategic Studies, in Proc. of the Workshop on the New Dimensions of Terrorism, 21-22, Singapore, 2002. Thomas, T. L., “Al Qaeda and the Internet: The Danger of ‘Cyberplanning,’” Parameters, Spring 2003, pp. 112-23, available at http://carlisle-www.army.mil/usawc/Parameters /03spring/thomas.htm. Tsfati, Y. and Weimann, G., “www.terrorism.com: Terror on the Internet,” Studies in Conflict & Terrorism, 25, pp. 317-332, 2002. Trevino, L. K., Lengel, R. H., and Daft, R. L., “Media symbolism, media richness, and media choice in organizations: A symbolic interactionist perspective.” Communication Research, 14(5), pp. 553-574, 1987. Qin, J., Zhou, Y., Reid, E., Lai, G. and Chen, H. (forthcoming). “Analyzing Terror Campaigns on the Internet: Technical Sophistication, Content Richness, and Web

12. Studying Global Extremist Organizations’ Internet Presence

265

Interactivity,” International Journal on Human Computer Studies, accepted for publication, forthcoming. Weimann, G., “www.terror.net: How Modern Terrorism Use the Internet,” Special Report, U.S. Institute of Peace, 2004, Available at http://www.usip.org/pubs/specialreports/ sr116.pdf. Whine, M., “Cyberspace: A New Medium for Communication, Command and Control by Extremists,” 1999, available at http://www.ict.org.il/articles/cyberspace.htm Xu, J. and Croft, B., “Querying Expansion using Local and Global Document Analysis.” in Proc. of the 19th Annual International ACM SIGIR Conference on Research and Development in Information Retrieval, Zurich, Switzerland, 1996. Zhou, Y., Reid, E., Qin, J., Chen, H., and Lai, G., “U.S. Domestic Extremist Groups on the Web: Link and Content Analysis,” IEEE Intelligent Systems Special Issue on Homeland Security, 20(5), pp. 44-51, 2005.

SUGGESTED READINGS · Sageman, M., (2004) Understanding Terror Network, University of Pennsylvania Press. A book written by Al Qaeda expert Dr. Marc Sageman which provides great insights into the understanding of terrorist networks. · Weimann, G., (2004) “www.terror.net: How Modern Terrorism Use the Internet,” Special Report, U.S. Institute of Peace. A report published by the U.S. Institute of Peace on global terrorist organizations’ Internet usage. · Jenkins, B. M., (2004) “World Becomes the Hostage of Media-Savvy Terrorists: Commentary”, USA Today, August 22, 2004. An article written by famous terrorism expert Brian M. Jenkins on terrorist organizations’ online propaganda activities. · ISTS, (2004) “Examining the Cyber Capabilities of Islamic Terrorist Groups”. Report, Institute for Security Technology Studies. A report published by the Institute for Security Technology Studies at the Dartmouth College on Islamic terrorist organizations’ online activities.

ONLINE RESOURCES · The RAND organization website http://www.rand.org. · The Institute for Counter-Terrorism website http://www.ict.org.il · The SITE (Search for International Terrorist Entities) Institute website. http://www.siteinstitute.org/

266

Chapter 12. Qin, et al.

DISCUSSION QUESTIONS 1. What other Web mining technologies can we use to detect and monitor terrorist organizations’ online activities more efficiently? 2. How can we improve the general public’s awareness and preparedness of the terror campaign in the cyber space? 3. What type of counter-terrorism measures should our government take in the cyber space?

13 CONTENT ANALYSIS OF JIHADI EXTREMIST GROUPS’ VIDEOS Arab Salem1, Edna Reid2, and Hsinchun Chen3

1

Private consultant ([email protected]); 2Department of Library Science, Clarion University, Clarion, Pennsylvania, U.S.A. ([email protected]); 3Management Information Systems Department, The University of Arizona, Tucson, Arizona U.S.A. ([email protected])

CHAPTER OVERVIEW This paper presents an exploratory study of jihadi extremist groups’ videos using content analysis and a multimedia coding tool to explore the types of video, groups’ modus operandi, and production features that lend support to extremist groups. The videos convey messages powerful enough to mobilize members, sympathizers, and even new recruits to launch attacks that are once again captured (on video) and disseminated globally via the Internet. They communicate the effectiveness of the campaigns and have a much wider impact because they are media rich with nonverbal cues and vivid images of events that can evoke not only a multitude of psychological and emotional responses but also violent reactions. The videos are important for jihadi extremist groups’ learning, training, and recruitment. In addition, the content collection and analysis of extremist groups’ videos can help policy makers, intelligence analysts, and researchers better understand the extremist groups’ terror campaigns and modus operandi, and help suggest counter-intelligence strategies and tactics for troop training.

267

Chapter 13. Salem, Reid & Chen

268

1.

INTRODUCTION

Technological advances and the decreasing cost and size, ease of use, and sophistication of video capturing and editing technology have made Webhosted audio and video clips a powerful and robust information platform and communication medium for terrorist/extremist groups (henceforth referred to as extremist groups). Extremist groups have become independent and prolific producers of multimedia artifacts that they feed not only to their own terrorist news network (Jenkins 2004) but to the legitimate global news networks, as well. As reported in news articles (BBC 2002; Coll and Glasser 2005) and reports (Becker 2005; SITE 2004a; Weimann 2004), multimedia resources such as audios and videos are widely used by jihadi extremist groups, such as Tandhim al-Qa’ida fi Bilad al-Rafidayn (al-Qaeda’s Organisation in 1 Mesopotamia) and Jaysh Ansar al-Sunna (Partisans of the Sunna Army), to spread and gain wider acceptance of their ideologies, justify their causes, raise funds, and show real results based on their view of justice. Many jihadi extremist groups’ multimedia artifacts are in Arabic and often posted (momentarily) in numerous discussion forums and websites to avoid intelligence surveillance (Becker 2005). For extremist groups, multimedia supports their resource mobilization strategy of using rich medium to visually communicate with audiences (e.g., their members, sympathizers, enemies, and the public). They create new knowledge in the form of multimedia to meet their strategic and tactical goals. From an organizational learning perspective, multimedia supports vicarious learning (learning by acquiring second-hand experience) for obtaining technical “know how” quickly (Huber 1991). Because of the sheer volume of extremist groups’ multimedia artifacts that are produced and disseminated via the Web, their evanescent nature, and cultural barriers, researchers expend substantial resources and effort to identify, monitor, translate, and analyze these video artifacts. This study is part of a larger effort called the Dark Web Portal research project that takes advantage of automatic methodologies for identifying, capturing, classifying, analyzing, and visualizing extremist groups’ multimedia web-based artifacts to support the research communities. This exploratory study analyzes extremist groups’ Arabic videos and constructs a coding scheme for examining the types of video, groups’ modus 1

Formerly Jamaat al-Tawhid wal-Jihad (Monotheism and Jihad), is a radical Islamist terrorist group affiliated with al Qaeda (Boucher 2004; SITE 2004c) and previously led by Abu Musab al Zarqawi who was killed in a US operation in June 2006. Via jihadi websites, the group has claimed responsibility for videotaped executions of many civilians such as Nicholas Berg (Boucher 2004).

13. Content Analysis of Jihadi Extremist Groups’ Videos

269

operandi, and production features, as well as the relevancy of the videos to the groups’ goals. The remainder of this paper is organized as follows. Section 2 reviews the related literature. Section 3 describes the research questions, the content analysis methodology, and creation of the coding scheme. Section 4 presents the results of the content analysis of extremist groups’ videos. The final section provides conclusions, implications, and directions for future research.

2.

RELATED WORK

In this section, we review trends in jihadi groups’ video usage, approaches for organizing and analyzing extremist videos, and video content analysis.

2.1

Jihadi Extremist Groups’ Usage of Videos

The jihadi extremist groups’ extensive use of the Web, technical sophistication, and media savvy have been described in several studies (Becker 2005; Chen et al. 2004; Weimann 2004; IntelCenter 2004). Their websites, blogs, and discussion forums provide hyperlinks to many video clips that vary in language (e.g., Arabic, English, French), size, format (e.g., wmv, ram), level of technical sophistication (e.g., amateur, professionally produced), and purpose (e.g., document attacks, boost morale, 9-11 anniversary commemoration). Some of the videos are mirrored hundreds of times at different websites or forums within a matter of days (Terrorist 2004). The persuasive messages make videos an important resource, which supports the collective mobilization of members and sympathizers. The resource mobilization approach provides a framework for emphasizing the importance of resources such as knowledge, money, labor, and communication media for social movement organizations (Duijvelaar 1996; Gustavon and Sherkat 2004). The extensive use of the Web, as described above, also supports extremist groups’ ability to adapt, enhance their organizational learning, and succeed. As described by Huber (1991, p.90), Jackson, et al., (2005) and Lutes (2001), the organizational learning process includes knowledge acquisition, information distribution, information interpretation, and organizational memory. The Web provides opportunities for groups to produce, interpret, share (e.g., lessons from insurgency in Afghanistan), and disseminate information (e.g., videos of beheadings) that fits their cultures, learning styles, preferences, and goals. In 2000, the Chechen rebels pioneered the creation of videos that capture their operations (Intelcenter 2005). Even if the attack against Russian

270

Chapter 13. Salem, Reid & Chen

soldiers was limited in scale, if the operation was filmed and then shown to the world the impact would be greater. Over the last few years, the filming of attacks, the sophistication of video production, quantity, and speed of video dissemination have become important operational and learning strategies for jihadi extremist groups around the world. According to Berger’s (2005) primer on terrorist videos, the vast majority of the web-based videos are simple, amateur productions filmed with handheld cameras or video cell-phones. Videos a) are a powerful and easy way to communicate messages quickly; b) are a cost-effective means to produce lots of information in a short amount of time; and c) can provide persuasive action, vivid images, and sound to reach viewer’s emotions (APS 2006). Professionally produced videos are released through the Al-Sahab Institute for Media Production (video production arm of al Qaeda) and appear frequently on the al-Jazeera channel as well as the Web (IntelCenter 2004). Videotaping extremist groups’ operations resulted in a mimetic effect, which Gladwell (2002) refers to as an “infectious idea.” Its multiplier effect among jihadi extremist groups emboldened them to produce more videos documenting their brazen attacks on soft targets (especially the beheadings of defenseless civilians), which are then disseminated via the Web. Extremist groups, such as al Qaeda and their avid sympathizers, have been incredibly successful in using videos to show their resolve (SITE 2004b), share messages (e.g., Osama Bin Laden’s speeches), and provide training (IntelCenter 2005). The popular press’ focus on video reporting (especially the beheadings) has gotten global attention (Robertson 2002; Coll and Glasser 2005), heightened the importance of the videos (Caught 2004), and may have unfortunately contributed to the increase of violence.

2.2

Collections of Extremist Videos

The mass production and dissemination of jihadi extremist groups’ videos have prompted several organizations to identify, monitor, collect, translate, and analyze such videos. Table 13-1 identifies commercial companies that support the counter-terrorism communities, such as IntelCenter (2005), and research centers, such as the Middle East Media Research Institute (MEMRI), that focus primarily on systematic analysis. Most of the organizations manually collect and analyze the videos and generate reports; while the Artificial Intelligence (AI) Lab at the University of Arizona collects videos using a systematic web spidering approach and performs research using content and link analysis. Some organizations provide fee-based access to their video collections; while the AI Lab’s Dark Web video collection is intended for systematic terrorism and intelligence

13. Content Analysis of Jihadi Extremist Groups’ Videos

271

studies. Table 13-1. Companies and research centers that support the counter-terrorism communities Organizations Collections # Videos URLs Commercial Global Terror Clearinghouse 134 http://www.globalterror Companies Alert on International titles alert.com/archive.html Director, E. Terrorism Kohlmann

Research Centers

IntelCenter Director, B. Venzke

Audio/Video

60 http://www.intelcenter volume .com s

Intelwire.com Editor, J.M. Berger

Jihad Videos Online Archive

208 titles

http://intelfiles.com/ (partial list of videos)

Ogrish

Hostage Archives

26 titles

http://www.ogrish .com/archives/terrorism / hostage

AI Lab, Univ. Arizona Director, H. Chen

Dark Web Portal testbed

680 titles

MEMRI

Jihad & Terrorism Studies Project

12 titles

http://ai.eller.arizona .edu/ (closed research collection) http://www.memri.org/ jihad.html

SITE Institute Director, R. Katz

Multimedia Catalog

400 titles

http://www.siteinstitute .org

1460 titles

Note: some are duplicate videos

Total (estimate)

2.3

Content Analysis of Videos

As indicated in Table 13-1, there are thousands of jihadi extremist groups’ videos. They contain massive amounts of information, including visual, text, and audio content (Dimitrova et al. 2002). The information are useful for analyzing the types of violence (Aikat 2004), violent trends in groups’ operations (SITE 2004a), leadership styles (SITE 2004c), and insight into the different networks (Intelcenter 2004). There is a wealth of content analysis studies of violence in television programs, video games (Lachlan et al. 2003), and online music videos (DuRant et al. 1997; Makris 1999). Content analysis is a methodology for making inferences by objectively and systematically identifying specific characteristics of messages (Holsti 1969). Since viewers can learn social norms and aggressive behavior through observing and cognitively processing violent scenes, video games and music

Chapter 13. Salem, Reid & Chen

272

video studies explore the levels and types of violence (e.g., number of violent acts, types of weapons used), and potential impacts of the videos (Lachlan et al. 2003; Aikat 2004). The studies used coding guidelines adapted from the National Television Violence Study (NTVS) and the Incident Classification and Analysis Form (ICAF) developed by the ABC Television Network and the Gerbner’s Violence Index for media research (Lachlan et al. 2003; Makris 1999; Aikat 2004). However, in-depth studies of the extremist groups’ videos such as patterns of the groups involved, types of violence, modus operandi (e.g., types of attacks, weapons, targets), and sophistication of videos are not available. Furthermore, if researchers want to use the video content (e.g., bombing or kidnapping scenes) and the content-based metadata for integration with other information (e.g., group profiles, attack incidents, news stories) for advanced analysis such as triangulation, entity extraction, and social network analysis then automated content analysis approaches (MOCA 2005; Wactlar 2000) are needed to extract structural and semantic content from the videos. This may require specialized tools such as terrorism ontologies (Guitouni, et al. 2002; Mannes and Golbeck 2005) be used in the content analysis process to untangle, map, and extract extremist groups’ patterns, events, group actions, and actors captured in the video. The Movie Content Analysis (MOCA 2005) and the Informedia Digital Video Library (Wactlar 2000; Wactlar and Chen 2002) projects are examples of pioneering research to conduct content analysis of continuous data, especially videos, and automatic extraction and summarization of information and objects. These types of automatic approaches are needed for a fine grained analysis and mining (e.g., identify similarities, patterns, anomalies) of videos which are primary source data generated by the groups. A systematic exploration of the content of the videos to enhance our understanding of how they are used to support extremist groups’ operations is therefore in order. In addition, research communities need coding guidelines, schemes, and other tools to support investigation of the videos. This study is an initial attempt to fill that gap.

3.

METHODOLOGY

Researchers have identified several factors that influence groups’ use of rich mediums such as videos. This study uses the resource mobilization (Duijvelaar 1996) framework to undertake a systematic content analysis of extremist groups’ videos. We aim to answer the research questions listed below.

13. Content Analysis of Jihadi Extremist Groups’ Videos

273

· What types of video, groups’ modus operandi, and production features are identified in extremist groups’ videos? · How are the videos used by the jihadi extremist groups? From a resource mobilization perspective, the use of the videos is viewed as a rational choice for enhancing the groups’ communications, propaganda, and training resources necessary to publicize and diffuse their campaigns. For this content analysis study, the unit of analysis is a video. The content analysis process includes several steps: selection of the sample collection of videos, generation of a list of content categories and associated content features, assessment of coding reliability, design of a coding tool (Multimedia Coding Tool), coding the videos, and analysis of results.

3.1

Sample Collection

The initial step is to construct a high quality collection of videos from extremist groups and/or their sympathizers. We used a collection development approach used by Zhou, et al. (2005) and Reid, et al. (2005, p.402) in their Dark Web portal project. The Dark Web is the alternate (dark) side of the Web which is used by extremist groups to spread their ideas. The approach involved identifying a set of seed URLs’ for extremist groups’ websites, manually searching major search engines using the group names as queries to find other websites, conducting in-link expansion from Google in-link search, filtering the collection, and automatically collecting the extremist groups’ websites and content using a spider program. The spider program harvests the websites and web files (e.g., html, php, pdf) including multimedia files. The files are harvested every 3-4 months with the latest collection (6th batch) downloaded in November 2005. Table 13-2 provides a summary of the 705 multimedia files that were downloaded. Table 13-2. Dark Web Multimedia Collection for 6th Batch (as of Nov 2005) # File Video Audio Duration Size Videos Formats Format Format (h :m :s ) (MB) 357 asf wmv wma 68:09:36 3,934.36 291 real real real 69:06:00 2,907.10 21 asf asf wma 01:59:20 112.70 13 quicktime quicktime quicktime 00:19:44 136.16 11 asf asf asf 02:15:30 216.28 5 real real none 00:10:22 23.82 4 mpeg mpeg mp2 00:03:42 37.03 3 quicktime mpeg4 quicktime 00:02:15 18.17 705 142:01:12 7,385.62

Avg. Size (MB) 11.02 9.99 5.37 10.47 19.66 4.76 9.26 6.06

Chapter 13. Salem, Reid & Chen

274

From the Dark Web multimedia collection (6th batch), we identified Arabic videos that were produced by jihadi extremist groups or their sympathizers. Many of the videos were shot in Iraq. We previewed the videos and looked for clues such as natural backdrops (desert, palm trees), language used (Arabic), and extremist groups’ name such as Tandhim alQa’ida fi Bilad al-Rafidayn. An arbitrary number of 20 videos was chosen for purposes of this exploratory study using a random number generator to select the sample.

3.2

Coding Tool and Scheme

We designed a Multimedia Coding Tool (MCT) that allows the coder to record his observations in a systematic and structured manner. The MCT stores both the coding scheme and the Arabic videos (e.g., wmv, rm) as well as supports database query. It supports the creation of new coding categories and direct coding of the videos. The content of videos produced by jihadi extremist groups was coded following the scheme based on features of videos, terrorism ontologies (Guitonni et al., 2002; Mannes and Golbeck 2005), the Intelcenter’s video categorization (2005), and the (narrowly scoped) domain of videos produced by jihadi extremist groups. The process of refining the scheme was incremental in nature. Table 13-3 summarizes the coding scheme that is arranged into class, content category, content feature, and description. Although there are 5 classes, the first four focus on the types of video such as violent attacks (e.g., suicide bombing) and others (e.g., message such as leader statement), the content properties (e.g., date of attack, location), groups involved (e.g., extremist group), and expressions (e.g., quotation). Production is the last class, which includes the technical features (e.g., subtitle, logo) of the video. Each class is subdivided into content category and feature that capture specific aspects of the videos. For example, the attack content category has content features that describe the group’s modus operandi such as planning, the target, and weapon used. Table 13-3. Coding Scheme Class Content Category 1.Types of Violent Attacks Video Attack

Hostage Taking

Content Feature

Description

Planning; Statement; Target; Weapon used (e.g., bombing)

All kinds of attacks except hostage taking and suicide bombing Person held against his/her will

Captive’s name; Captive’s nationality;

13. Content Analysis of Jihadi Extremist Groups’ Videos Class

Content Category

Suicide Bombing

Others Message

2. Content Properties

Tribute; Leader Statement; Newsletter

Education

Instruction; Training

Victim

Number of person(s); Name(s); Nationality; Civilian/Military Hijri (Islamic) Calendar; Julian Calendar City; County; District; Town; Country Person; Organization; Country Reported name ; Subgroup; Media agency Religious quotation; Violent quotation Arab Media; Western Media Title of the video; Sound; Visual (e.g., subtitle); URL; Multiclip

Date of Attack Location Target of threat 3. Groups

Extremist group

4. Expression

Quotation Reference to Media

5. Production

Content Feature Demand; Execution; Hostage ; Negotiation; Statement Method; Suicider’s name; Suicider’s nationality; Statement; Target

Production Feature

275 Description

Bombing carried out by a person who does not hope to survive it Statement by prominent members of the extremist group (IntelCenter, 2005) Instruction is for teaching specific skills, while training is for documenting activities Injury or loss of life Reported attack date in the video Location of depicted event Threatened entity Group involved Quotation used Mention of media Video feature

Figure 13-1 displays the MCT interface for coding videos that identified extremist groups such as Tandhim al-Qa’ida fi Bilad al-Rafidayn. The group’s names (e.g., Arabic and English), types of video, and other information were coded. A multiclip video file was coded as a single entry. Four videos from our sample are coded independently by two domain specialists. The coding scheme is iteratively revised until a satisfactory level of agreement between the coders is reached. Category reliability is measured using Holsti’s formula for computing reliability (Holsti 1969). The

Chapter 13. Salem, Reid & Chen

276

percentage agreement between the two coders was higher than 0.80 for all the content categories that were analyzed.

Figure 13-1. MCT Interface for Coding Extremist Group’s Information

4.

RESULTS

Twenty Arabic videos were content analyzed. The average length of the sample videos was 3 minutes and 6 seconds. Important content analysis results indicate: types of video, names of extremist groups involved, groups’ modus operandi (e.g., targets, weapons, attack locations), and production features (e.g., subtitles, logos) that lend support to extremist groups.

4.1

Types of Video

The types of video were organized into two categories: violent attacks (e.g., suicide bombing) and others (e.g., message such as leader statement). Table 13-4 provides the frequency count for the types of video identified. The attack video (which includes all types of attacks except hostage taking

13. Content Analysis of Jihadi Extremist Groups’ Videos

277

and suicide bombing) was the most frequently identified. The videos are often filmed in real-time (show the attacks in action), instructive (takes the viewer inside the planning and attack execution processes including scenes of the different weapons, such as rocket propelled grenades, and skills required for their operations), and low budget (limited promotional costs as indicated by low quality of some videos and appeal to diverse audiences because of Arabic and English subtitles). The plots were simple (focus on a few goals such as to destroy the enemy’s tankers), versatile (can be used for meetings, training, fundraising, motivational sessions), persuasive (display actors’ emotions and dedication), succinct (quickly present the materials in short videos), and targeted (producers have complete control over the message and sequence of events). The videos also demonstrated rituals such as wearing a headdress that completely covers the face so only the eyes are visible. Table 13-4. Types of Video Types of Videos Violent Attacks

Others

4.2

Attack Hostage Taking Suicide Bombing Subtotal Message Total

Frequency 13 1 4 18 2 20

Groups Identified

Although 15 extremist groups were identified, there were only 9 unique groups that took credit for the videos. In 5 videos the groups did not identify themselves. Two groups, Al-Jabha al-Islamiya lil-Muqawama al-’Iraqiya (the Islamic Front of the Iraqi Resistance) (JAMI) and the Tandhim alQa’ida fi Bilad al-Rafidayn, produced a total of eight videos that were in our sample. Both represent insurgency groups in Iraq. Among the groups identified, 7 were involved in violent attacks. Extremist groups, such as al Zarqawi’s Tandhim al-Qa’ida fi Bilad alRafidayn, produced videos which include planning meetings (with maps, diagrams, and logistic preparations) before the suicide bombings. The videos stimulated solidarity because they made one feel a part of the campaign against the ‘enemies.’ They supported mental models of the group members’ dedication, closeness, emotional rituals, and skills as they executed the attacks. Scenes provide emotional and spiritual support because of the hugging, greeting, and praying together.

Chapter 13. Salem, Reid & Chen

278

4.3

Groups’ Modus Operandi

Since many of the videos involve attacks in Iraq, the major targets are Western military humvees, cargo convoys, and other vehicles. Figure 13-2 provides a chart of the types of targets identified. Most of the videos explicitly mentioned locations of the depicted attacks. The locations are often mentioned in the subtitles and occasionally the narrator provides it. Infantry/Pedestrians Supply Vehicles 5% Other Facilities

10% 24%

Military Bases

Vehicles

10%

61% Infantry Transport Vehicles

19%

Figure 13-2. Target Sites Identified in Sample Videos

32%

Other Military Vehicles

Figure 13-3. RPG Attack to Disrupt a Supply Line

These results are compatible with media reports on the Iraqi insurgency. Most attacks occur in the Sunni triangle, which includes: Balad, Dayali, Baghdad, Fallujah, and Abu-Ghraib. In addition, U.S. military installations in Mosul are frequently attacked, as reported in the international media.

13. Content Analysis of Jihadi Extremist Groups’ Videos

279

Roadside bombs and RPGs (handheld antitank grenade-launchers) are the most common types of weapons utilized. They are more effective than machine guns in hit and run attacks. Figure 13-3 provides a snapshot of a video of someone shooting an RPG to disrupt a supply line. The RPG is an inexpensive and single-shot weapon that is easy to operate with very little training but extremely effective (Military 2006). The RPG and mortar attacks can cause considerable damage without being in closerange engagements.

4.4

Production Features

Eleven sample videos had both Arabic or English subtitles and logos. A range of production quality patterns, from amateurish to professional, were identified. In addition, diverse visual production patterns were identified such as the use of subtitles (English or Arabic), the groups’ logos, background hymns (with/without music), and excerpts of leaders’ speeches. Figure 13-4 provides a screenshot of a video with English subtitles by al Qaeda that shows Bin Laden giving a speech. Bin Laden messages are often directed towards a worldwide audience. Al Qaeda’s media agency ”AlSahab” produced the “Bin Laden interview excerpt” in our sample. This agrees with the SITE Institute (2004b) and Intelcenter’s (2005) reports about al Qaeda’s use of a production company to plan and produce high quality videos.

I swear by Allah, I ask Allah to bless this number which I see in front of me.

Al-Sahab

Figure 13-4. Video by al Qaeda with English subtitles

Chapter 13. Salem, Reid & Chen

280

Thirteen videos had Arabic subtitles. Ideologies and customs identified in the videos were consistent with real-world activities. For example, hymns in Tandhim al-Qa’ida fi Bilad al-Rafidayn videos were not accompanied by musical instruments, abiding by the strict stance on the use of such 2 instruments in Salafi jihad ideology . In summary, the videos convey messages powerful enough to mobilize members, sympathizers, and even new recruits to launch attacks that are once again captured (on video) and disseminated globally via the Internet. They are important for the survival and growth of jihadi extremist groups’ because they support propaganda, fundraising, learning, training, and recruitment.

5.

CONCLUSION

In this study, we conducted an exploratory analysis of 20 Arabic extremist groups’ videos and designed a Multimedia Coding Tool (MCT) as well as a coding scheme for examining the content. We identified different types of videos, extremist groups, modus operandi (e.g., targets, weapons, attack locations), and video production features (e.g., subtitles, logos). Eighteen videos were violent attacks in which some included planning sessions with maps, diagrams, and logistic preparations. By creating their own training and operational videos, the extremist groups support organization learning in several ways such as the groups producing the video get first hand experience (learn by doing) and those viewing the video get second hand experience (learn by imitation). Since jihadi extremist groups’ multimedia collections will continue to increase, automatic extraction of structural (e.g., subtitles, images) and semantic content (e.g., weapons, target locations) can aide in the systematic analysis of the groups’ modus operandi, violent events, learning styles, networks, and tactical operations. Therefore, we need to expand our efforts to analyze multimedia content by creating collaborations with research teams in the automated video content analysis domains. The results of this research are relevant for our Dark Web project, in that it provided a glimpse into some of the challenges in analyzing Arabic extremist groups’ videos. Because this study was limited to a sample of 20 Arabic video clips, future studies of this kind should endeavor to enlarge the sample and verify if similar results were found. Further research should also

2

Salafi jihad ideology advocates the use of violence against any foreign or non-Muslim government or population (the “far enemy”) to establish an Islamist state in a core Arab region (Sageman 2005).

13. Content Analysis of Jihadi Extremist Groups’ Videos

281

be done to provide insights into extremist groups’ operations, organizational learning styles, and diffusion of multimedia. Finally, we plan to expand our efforts by collaborating with research teams in the automated video content analysis domains such as the Movie Content Analysis (MOCA 2005) and the Informedia Digital Video Library (Wactlar 2000) projects. Systematic extraction and analysis of videos would facilitate correlation and triangulation of information from different sources (e.g., groups’ websites, news articles, incident chronologies, reports, discussion forums) as well as improve analytical capabilities.

6.

ACKNOWLEDGEMENTS

This research has been supported in part by the following grants: · DHS/CNRI, “BorderSafe Initiative,” October 2003-March 2005. · NSF/ITR, “COPLINK Center for Intelligence and Security Informatics – A Crime Data Mining Approach to Developing Border Safe Research,” EIA-0326348, September 2003-August 2005. We would like to thank all of the staff of the Artificial Intelligence Lab at the University of Arizona who have contributed to the project, in particular Wei Xi, Homa Atabakhsh, Catherine Larson, Chun-Ju Tseng, and Shing Ka Wu.

REFERENCES Aikat, D. (2004) Streaming Violent Genres Online: Visual Images in Music Videos on BET.com, Country.com, MTV.com, VH1.com. Popular Music and Society 27. APS (2006) 17 1/2 Advantages of Using Video. Fort Mill, APS. BBC (2002) Video Shows al-Qaeda Terrorist Training. BBC. Becker, A. (2005) Technology and Terror: the New Modus Operandi. Frontline. Washington, D.C., PBS. Berger, J. M. (2005) Short Primer on Terrorist Videos. Intelfiles, Alexandria, Virginia. http://www.intelfiles.com Boucher, R. (2004) Foreign Terrorist Organization: Designation of Jama'at al-Tawhid wa'al Jihad and Aliases. Press Statement. Washington, D.C., U.S. Department of State. Caught on Tape: Video as a Terrorist's Weapon. (2004) ABC News Internet Ventures. Qin, J., Zhou, Y., Lai, G., Reid, E., Sageman, M., and Chen, H. (2005) The Dark Web Portal Project: Collecting and Analyzing the Presence of Terrorist Groups on the Web. Proceedings of the IEEE International Conference on Intelligence and Security (ISI 2005), Atlanta, Georgia. Coll, S. and S. Glasser (2005) Rifles and Laptops al-Qaeda's New Armoury. Washington Post. Washington, D.C. Dimitrova N., Zhang H-J., Shahraray B., Sezan I., Huang T., Zakhor A. (2002) Applications of Video-content Analysis and Retrieval. IEEE Multimedia: 42-55.

282

Chapter 13. Salem, Reid & Chen

Dominick, J. R. (1984) Videogames, Television Violence, and Agression in Teenagers. Journal of Communication 34: 136-147. Duijvelaar, C. (1996) In the Books: Theoretical Outlines. Resource Movilization Approach. East-East Cooperation Among Environmental NGOs in Central and Eastern Europe. Budapest, Regional Environmental Center for Central and Eastern Europe. DuRant R.H., Rich M., Emans S.J., Rome E.S., Allred E., Woods E.R.. (1997) Violence and Weapon Carrying in Music Videos: a Content Analysis. Arch Pediatr Adol Med 15(1): 443-338. Fong, T. (2005) Indonesia: Terror Groups Spreading Video Bomb-making Guide. Jakarta Post. Jakarta. Ghashghai, E. and R. Lewis (2002) Issues Affecting Internet Use in Afghanistan and Developing Countries in the Middle East. Issue Paper. R. Corporation, RAND Corporation. Gladwell, M. (2002) Tipping Point: How Little Things Can Make a Big Difference, Little Brown & Company. GlobalSecurity (2005) Jaish Ansar al-Sunna. Military, GlobalSecurity.org. Gossett, S. (2006) al Qaeda Video is Green Light for an Attack: Analyst Warns. CNS News. Gustavson, A.T. and D.E. Sherkat (2004) Elucidating the Web of Hate: the Ideological Structuring of Network Ties among Right Wing Hate Groups on the Internet. Annual Meetings of the American Sociological Association, (ASA) Guitonni, A., A. Boury-Brisset, et al. (2002) Automatic Documents Analyzer and Classifier. 7th International Command and Control Research and Technology Symposium, Quebec. Holsti, O. R. (1969) Content Analysis for the Social Sciences and Humanities. Reading, Addison-Wesley. Huber, G. P. (1991) Organizational Learning: Contributing Processes and the Literatures. Organization Science 2(1): 88-114. Intelcenter (2004) Al Qaeda Videos & 3rd 9-11 Anniversary v1.0. Intelcenter, Alexandria, Virginia. Intelcenter (2005) Evolution of Jihad Video, v1.0. IntelCenter, Alexandria, Virginia. Brian A. Jackson, John C. Baker, Peter Chalk, Kim Cragin, John V. Parachini, Horacio R. Trujillo (2005) Aptitude for Destruction: Organizational Learning in Terrorist Groups and its Implications for Combating Terrorism. RAND Corporation. Jenkins, B. M. (2004) World Becomes the Hostage of Media-Savvy Terrorists: Commentary. USA Today. Kelley, J. (2001) Militants Wire Web With Links to Jihad. USA Today. Lachlan, KA, Smith, SL, Tamborini, R. (2003) Popular Video Games: Assessing the Amount and Context of Violence. Annual Meeting of the National Communication Association, Seattle, Washington. Lutes, C. (2001) al Qaida in Action and Learning: a Systems Approach. . Fulfillment of Course Requirements. George Washington University. http://www.au.af.mil/au/awc/awcgate/readings/al_qaida2.htm Makris, G. (1999) Searching for Violence on the Internet: an Exploratory Analysis of MTV Online Music Video Clips, North Caroline, Chapel Hill. Mannes, A. and J. Golbeck (2005) Building a Terrorism Ontology. ISWC Workshop on Ontology Patterns for the Semantic Web, Military Factor (2006) Rocket Propelled Grenade. MilitaryFactor.com. http://www.militaryfactor.com/smallarms/ MOCA (2005) Overview: Movie Content Analysis Project (MoCA) Univ. Mannheim. Mannheim.

13. Content Analysis of Jihadi Extremist Groups’ Videos

283

Reid, E., J. Qin, et al. (2005) Collecting and Analyzing the Presence of Terrorists on the Web: a Case Study of Jihad Websites. Intelligence and Security Informatics: IEEE International Conference on Intelligence and Security Informatics, ISI 2005, May 2005, Atlanta, Georgia. Springer. Robertson, N. (2002) Tapes Shed New Light on bin Laden's Network. cnn.com. Sageman, Marc (2005) Undersanding Jihadi Networks. Strategic Insights, Volume IV(4) http://www.ccc.nps.navy.mil/si/2005/Apr/sagemanApr05.asp SITE (2004a) Jaish Ansar al Sunah Insurgency Group in Iraq Issues a Clarification Statement and Video Regarding the Blessed Attack Against the American Base in Mosul. SITE Institute. Washington, D.C. SITE (2004b) Manufacture of the Explosive Belt for Suicide Bombing Operations. SITE Institute. Washington, D.C. SITE (2004c) Communique No. 11 Issued by Zarqawi's Attawhid Wal Jihad Group Military Department. SITE Publications. SITE Institute. Washington, D.C. Smith, S. L., Wilson, B. J., Kunkel, D., Linz, D., Potter, W. J., Colvin, C. M., Donnerstein, E. (1998) National Television Violence Study: Vol. 3. Violence in television programming overall: University of California, Santa Barbara study (pp. 5-220). Newbury Park, CA: Sage. Terrorists threaten more attacks on Britain. (2005) News from Russia. Wactlar, H. (2000) Informedia: Search and Summarization in the Video Medium. Proceeedings of Imagina 2000 Conference, January 31-Februrary 2, 2000, Monaco, France. Wactlar, H. and Chen, C. (2002) Enhanced Perspectives for Historical and Cultural Documentaries Using Informedia Technologies. Joint Conference on Digital Libraries (JCDL’02), July 13-17, 2002, Portland, Oregon. Weimann (2004) www.terror.net How Modern Terrorist Uses the Internet. Washington, D.C., U.S. Institute of Peace. Zhou, Y., Reid, E., Qin, J., Chen, H., Lai, G. (2005) U.S. Domestic Extremist Groups on the Web: Link and Content Analysis. IEEE Intelligent Systems: 44-51.

SUGGESTED READINGS · Berger, J. M. (2005) Short Primer on Terrorist Videos. Intelfiles, Alexandria, Virginia. http://www.intelfiles.com · Qin, J., Zhou, Y., Lai, G., Reid, E., Sageman, M., and Chen, H. (2005) The Dark Web Portal Project: Collecting and Analyzing the Presence of Terrorist Groups on the Web. Proceedings of the IEEE International Conference on Intelligence and Security (ISI 2005), Atlanta, Georgia. · Weimann (2004) www.terror.net How Modern Terrorist Uses the Internet. Washington, D.C., U.S. Institute of Peace.

ONLINE RESOURCES · Intelcenter (2004) Al Qaeda Videos & 3rd 9-11 Anniversary v1.0. Intelcenter, Alexandria, Virginia

284

Chapter 13. Salem, Reid & Chen

http://www.intelcenter.com · Intelcenter (2005) Evolution of Jihad Video, v1.0. IntelCenter, Alexandria, Virginia

http://www.intelcenter.com

· Memorial Institute for the Prevention of Terrorism (MIPT). Terrorism Knowledge Base http://www.tkb.org · Sageman, Marc (2005) Undersanding Jihadi Networks. Strategic Insights, Volume IV(4) http://www.ccc.nps.navy.mil/si/2005/Apr/sagemanApr05.asp · Weimann (2004) www.terror.net How Modern Terrorist Uses the Internet. Washington, D.C., U.S. Institute of Peace http://www.institutepeace.org

DISCUSSION QUESTIONS 1. How are extremist groups using video technologies to support their campaigns? 2. How can officials use the videos to enhance their knowledge about the groups’ operations and learning styles? 3. What other Internet technologies are being exploited by extremist groups?

14 ANALYSIS OF AFFECT INTENSITIES IN EXTREMIST GROUP FORUMS Ahmed Abbasi and Hsinchun Chen Management Information Systems Department, The University of Arizona, Tucson, Arizona, U.S.A.([email protected], [email protected]}

CHAPTER OVERVIEW Affects play an important role in influencing people’s perceptions and decision making. Affect analysis is useful for measuring the presence of hate, violence, and the resulting propaganda dissemination across extremist groups. In this study we performed affect analysis of U.S. and Middle Eastern extremist group forum postings. We constructed an affect lexicon using a probabilistic disambiguation technique to measure and visualize usage of violence and hate affects. These techniques facilitate in depth analysis of multilingual content. The proposed approach was evaluated by applying it across 16 U.S. supremacist and Middle Eastern extremist group forums. Analysis across regions reveals that the Middle Eastern test bed forums have considerably greater violence intensity than the U.S. groups. There is also a strong linear relationship between the usage of hate and violence across the Middle Eastern messages.

285

286

1.

Chapter 14. Abbasi & Chen

INTRODUCTION

The fast propagation of the Web has fueled the increased popularity of computer mediated communication. Computer mediated communication (CMC) research has become an important focus with areas of inquiry including analysis of social behavioral factors pertaining to online communities as well as some of the vices associated with web-based communication. In addition to misuse in the form of deception [1], software piracy [2] and pornography [3], the internet has also become a popular communication medium for extremist and hate groups. This aspect of the internet is often referred to as the Dark Web [4]. Stormfront, what many consider to be the first hate group web site [5], was created around 1996. Since then researchers and hate watch organizations have begun to focus their attention towards studying and monitoring such online groups [6]. Nevertheless, there has been limited evaluation of forum postings, with the majority of studies focusing on web sites. Burris et al. [7] acknowledged that there was a need to evaluate forum and chat room discussion content. Schafer [8] also stated that it was unclear as to how much and what kind of extremist forum activity was going on. Due to the lack of understanding and current ambiguity associated with the content of such groups’ forum postings, analysis of extremist group forum archives is an important endeavor. Sentiment analysis attempts to identify and analyze opinions and emotions. Hearst [9] originally proposed the idea of mining direction-based text (text containing opinions and emotions). Traditional forms of content analysis, such as topical analysis may not be effective for forums. Nigam and Hurst [10] found that only 3% of USENET sentences contained topical information. In contrast, web discourse is rich in sentiment and affects related information [11]. In recent years, sentiment analysis has been applied to various forms of web-based discourse [12]-[13]. Application to extremist group forums can provide insight into important discussion and trends. Affect analysis is the category of sentiment analysis dealing with emotions/affects. Affects play an important role in influencing people’s perceptions and decision making [14]. Consequently affect analysis is useful for measuring the presence of hate, violence, and the resulting propaganda dissemination in hate/extremist forums. In this study we perform affect analysis of extremist group forum postings. We constructed an affect lexicon using a probabilistic disambiguation technique to measure usage of violence and hate affects. Our analysis encompassed measuring and visualizing affect intensities and correlations across these forums. The results provide significant insight into the affect related content within and across regions.

14. Analysis of Affect Intensities in Extremist Group Forums

287

The remainder of this paper is organized as follows. Section 2 presents a review of current research on hate/extremist groups on the web as well as an examination of existing literature pertaining to affect analysis. Section 3 describes research gaps, and questions while Section 4 outlines our proposed research design. Section 5 presents the system design used for implementing our affect analysis techniques and Section 6 presents a description of the evaluation methods and proposed hypotheses. Section 7 describes the experimental results and Section 8 concludes with closing remarks, limitations, and future directions.

2.

RELATED WORK

2.1 Analysis of Extremist Groups on the Web There have been several studies analyzing the presence of hate/extremist groups on the web in recent years. Extremist groups often use the Internet to promote hatred and violence [15]. The Internet offers a ubiquitous, quick, inexpensive, and anonymous means of communication for extremist groups [16]. Consequently many believe that the internet acts as an ideal method for such groups to disseminate information and spread propaganda [17]-[18]. Schafer [8] performed an extensive analysis of the content of 132 White supremacist websites. Burris et al. [7] used social network analysis to evaluate white supremacist networks on the internet, based on 80 web sites. Their analysis included an evaluation of the level of interaction between the various groups (e.g., skinheads, neo-Nazis, KKK, militia, etc.) based on link densities. They found that there was considerable communication between certain web sites in terms of in and out links. Gerstenfeld et al. [19] performed a content analysis of 157 U.S. hate group web sites and also found considerable linkage between certain groups. Gustavson et al. [20] surmised that white supremacist factions used the internet as a means for ideological resource sharing. Zhou et al. [21] did an in depth analysis of U.S. hate group web sites and found significant evidence of fund raising, propaganda, and recruitment related content. Abbasi and Chen [22] also corroborated signs of the usage of the web as a medium for propaganda by U.S. supremacist and Middle Eastern extremist groups. These findings provide insight into extremist group web usage tendencies and also suggest that there may be many usage similarities across regions. However the extent of those similarities is unclear due to limited work on non-U.S. groups. Furthermore, there has been little analysis of extremist group web forums. Burris et al. [7] acknowledged the need to evaluate forum

288

Chapter 14. Abbasi & Chen

and chat room discussion content. While Schafer [8] performed an extensive analysis of the content of White supremacist websites, he was also unclear as to how much and what kind of forum activity was going on with respect to extremist groups. The lack of previous analysis of these forums can be attributed to the large volumes of information contained in such archives combined with the predominantly manual analysis methods incorporated in previous studies [21]. Manual examination of thousands of messages can be an extremely tedious and labor intensive effort when applied across thousands of forum postings. With increasing usage of CMC, the need for automated text analysis techniques has grown in recent years. These include techniques for stylometric, topical, genre, and sentiment analysis. We focus primarily on sentiment analysis for two reasons. Firstly, web discourse is rich in opinion and emotion related content. Secondly, analysis of this type of text is highly relevant to propaganda usage on the web, which attempts to use opinionated content to create and exploit biases and stereotypes.

2.2

Sentiment Analysis

Sentiment analysis is concerned with analysis of direction-based text, i.e. text containing opinions and emotions. There are two basic types of sentiment analysis tasks: classification and content analysis. Sentiment content analysis uses features shown to provide effective sentiment discrimination for content analysis. Sentiment classification deals with classifying sentiments or affects. Sentiment content analysis is concerned with evaluation of sentiment related phenomenon such as sentiment and/or affects balance and temporal trends. Sentiment content analysis can be further divided into two categories: sentiment balance and affect analysis. We are concerned with applying affect analysis to extremist forums. Sentiment balance and affect analysis have many similarities, including the techniques and application domains. The major difference is the underlying features used (sentiment polarity versus affect lexicons). Consequently, we review all previous sentiment content analysis research first, and then focus on affect analysis. Common sentiment content analysis characteristics include the tasks, techniques, and application domains. These are summarized in the taxonomy presented in Table 14-1. Based on the proposed taxonomy, Table 14-2 shows previous studies dealing with sentiment content analysis. We discuss the taxonomy and related studies in detail below.

14. Analysis of Affect Intensities in Extremist Group Forums

289

Table 14-1. A Taxonomy of Sentiment Content Analysis Research Tasks Category Description Sentiment Balance Classifying sentiment polarity Affect Analysis Evaluating sentiment balance and temporal trends

Label C1 C2

Category Intensity Scores Visualization Manual

Techniques Examples Phrase pattern matching, affect intensity, etc. Loom, radar charts, etc. Manual coding of affects/sentiments.

Label T1 T2 T3

Category Reviews Web Discourse News Articles

Domains Description Product, movie, and music reviews Web forums and blogs Online news articles and documents

Label D1 D2 D3

Table 14-2. Previous Studies in Sentiment Content Analysis Tasks Temporal Techniques Study Analysis C C Y/N T T T 1 2 1 2 3 Donnath et al., √ Yes √ 1999 √

Subasic & Huetner, 2001

No

√

√

Domains D 1

D 2 √

D 3

Multilingual Y/N No

√

No

Tong, 2001

√

Yes

√

√

√

No

Morinaga et al., 2002

√

No

√

√

√

No

No

√

√

No

√

No

√

√

Liu et al., 2003 Nasukawa & Yi, 2003

√ √

Grefenstette et al., 2004

√

Henley et al., 2004 Glance et al., 2005

√

Liu et al., 2005 Robinson, 2005 Yi & Niback, 2005

√

Wiebe et al., 2005

√

No √

√

√

No

√

√

√

Yes No No

No √

√

√

No √

√ √

No No

√ √

√

No No

√

No

√

√ √

Yes √

No

√

No

290

Chapter 14. Abbasi & Chen

2.2.1 Tasks There are two common types of sentiment content analysis tasks: sentiment balance and affect analysis. Sentiment balance measures the breakdown of positive/negative sentiments across corpora [23]-[10]. Tong [24] generated sentiment timelines for move reviews which demonstrated how people perceived certain movies over time. Liu et al [25] developed the Opinion Observer tool to analyze and compare product sentiments. A closely related area is affect analysis which attempts to analyze emotions instead of sentiments. Sample affect classes include happiness, sadness, anger, horror etc. [11]-[16]-[27]. Donath et al. [28] visualized a lexicon of anger related terms. They were able to infer that a large proportion of messages from a Greek USENET group had an angry tone. Subasic and Huettner [11] performed affect analysis of various categories including violence and anger while Mishne [27] performed affect analysis on web blogs. Henley et al. [29] evaluated the frequency of various violence referents in anti-gay attack news reports in two major newspapers. They found that the terms used reflected the views of the writers. 2.2.2 Sentiment Content Analysis Techniques Previously used techniques for sentiment content analysis can be classified into three categories which include score-based approaches, visualization techniques, and manual coding methods. Visualization and automatically computed usage scores have been used most often. Scores-based approaches have been used for measuring sentiment and affect intensity. Scores are generally determined based on feature summation or averaging. Summation approaches believe that the additional presence of features strengthens the sentiment or affect within a document. Averaging methods assume that a weak intensity feature coupled with a strong intensity feature will result in medium intensity since the weak feature offsets some of the strength of the high intensity term. Subasic and Huettner [11] measured affect intensity as the average of term intensities across a document. A popular summation based sentiment intensity approach is the phrase pattern matching technique [23]-[30]. This technique assigns each positive phrase “+1” and negative “-1”. The overall message/document score can be used to determine the sentiment polarity and intensity (e.g., messages with a positive sum score have positive intensity). Henley et al. [29] used a summation approach for affect intensity where the message/document intensity is the summation of each feature’s frequency multiplied by its affect weight. Various visualization techniques have been used to view sentiment and

14. Analysis of Affect Intensities in Extremist Group Forums

291

affect trends. Timelines [24] visualizes sentiment balance over time for movie reviews. Loom [28] visualizes temporal usage patterns for different types of affects (e.g., angry, informative, etc.). Subasic and Huettner [11] used radar charts to visualize features relating to various affects (e.g., anger, violence, hate). Morinaga et al. [31] used principal component analysis to visualize the key sentiment features for various digital cameras based on product reviews. Manual methods entail reading and coding every message. Henley et al. [29] manually coded newspaper articles for biases pertaining to violence related reports. Robinson [32] manually classified thousands of message sentiments relating to the war in Iraq across English, French, and Brazilian forums. Manual approaches have the advantage of being more accurate and reliable than automated techniques since they are not hindered by interpretation of ambiguous language. However, these techniques can be exhausting and time consuming. 2.2.3 Sentiment Analysis Domains Sentiment analysis has been applied to numerous domains including reviews, web discourse, and news articles. Reviews include movie, product, and music reviews [31]-[33]-[34]. Sentiment analysis of movie reviews is considered to be challenging since movie reviewers often present lengthy plot summaries and also use complex literary devices such as rhetoric and sarcasm. Web Discourse sentiment analysis includes evaluation of web forums, newsgroups, and blogs. These studies assess sentiments about specific issues/topics. Sentiment topics include abortion, gun control, and politics [12]-[13]. Robinson [32] evaluated sentiments about 9/11 in three forums in the United States, Brazil, and France. Donnath et al. [29] evaluated the USENET forum alt.soc.greek for sentiments relating to anger and aggression. Sentiment analysis has also been applied to news articles [30]-[39]. Henley et al. [29] analyzed newspaper articles for biases pertaining to violence related reports. They found that there was a significant difference in between the manner in which the newspapers reported news stories with the reporting style reflecting newspaper sentiments. Some general conclusions can be drawn from Table 14-2 and the literature review. Most previous studies have focused on English data, predominantly in the review domain, with lesser emphasis on forum discourse. Furthermore, there has been limited temporal analysis of sentiment related content.

292

Chapter 14. Abbasi & Chen

2.3 Affect Lexicons A central component of affect analysis is the affect lexicon. Affect lexicons are manually crafted lexicons with words/phrases for specific emotions [36]. Each term in the lexicon receives an intensity score [11]-[29] that is typically assigned manually. For example, “kill” is more intense than “hit” in a violence affect lexicon. An important assumption of the intensity assigned to an affect feature is that it is contingent upon the feature being used in the appropriate context. However, terms can have different meanings depending on the context. Such affect ambiguity is particularly evident for verbs. Even part-of-speech tagging can’t help disambiguate the usage of “hang” in the example presented in the table below. Only two of the three sentences convey violent affect. In order to overcome this problem, several methods have been proposed to compensate for affect term/phrase ambiguity [11]-[37]. “I’m going to hang elves on the tree.” “Hang those savages!” “We should hang him for those crimes.” Liu et al. [37] combined different NLP models with a real-world knowledge database (Common Sense Database). The rationale behind this approach is to use knowledge bases to alleviate this ambiguity. In contrast, Subasic and Huettner [11] devised an approach that embraces ambiguity rather than trying to remove it. Their Fuzzy Semantic Typing method assigns each feature to multiple affect categories with varying intensity scores depending upon the word and usage context. For example, the word “alarm” is assigned to the fear, warning, and excitement affect categories with different intensities. Although the accuracy for specific term affects may be inaccurate, the fuzzy logic approach is intended to capture the essence of a document’s various affect intensities. While the two aforementioned disambiguation methods use automated techniques to reduce linguistic affect ambiguity, manual coding [29] avoids ambiguity altogether by reading through all the text.

3.

RESEARCH GAPS AND QUESTIONS

Based on our review of previous literature and conclusions we have identified several important research gaps. Firstly, there has been no

14. Analysis of Affect Intensities in Extremist Group Forums

293

previous analysis of affect intensity in extremist group forums. Secondly, there has only been a single multilingual sentiment content analysis study. Thirdly there has been little work on affect intensity relationships (interaction/correlation between affects). Finally, there has been no previous work on analysis of affect feature usage variation (across documents and over time).

3.1 Multilingual Extremist Group Forums Most previous sentiment analysis of web discourse has focused on USENET and financial forums. Applying such methods to extremist forums is important in order to assess the presence of propaganda, anger, and hate. Furthermore there has been little evaluation in a multilingual context with the exception of Robinson [32] performing manual analysis of Brazilian and French forums. The global nature of the internet necessitates more multilingual analysis.

3.2 Affect Intensity and Relationships There is a need to evaluate the intensity of terms relating to violence and racism/hate affects. These affects can provide a good indication of the level of animosity and aggression in these forums [32]. Furthermore, previous work has focused on the intensity of affects within a document or corpus, but there has been no work assessing the relationships between the usages of different affects across text. The relationship between affects is also important. Forums with elevated usage of violence and hate may have greater propaganda and violent intent.

3.3 Affect Usage Variation Previous affect analysis has looked to evaluate the level of affect intensities at a given point in time. Temporal variation is a good indicator of how consistent a forum’s content is over time. Dynamic forums may undergo greater variations based on current events or other external factors.

4.

RESEARCH QUESTIONS

We propose the following research questions: 1. How do extremist groups differ in terms of their violent and hateful affect intensities? 2. Is there any relationship between the occurrence of violent and hateful

294

Chapter 14. Abbasi & Chen

affects across regions? 3. How do these groups’ affect intensities vary over time?

5.

RESEARCH DESIGN

In order to address these research questions, we developed a generic affect analysis method that can be applied in a multilingual text setting. Our approach utilizes probabilistic disambiguation to overcome affect ambiguity in the lexicon creation phase. We also visualized affect intensities over time to evaluate trends. Our affect lexicon creation phase involves overcoming ambiguity using probabilistic disambiguation. Other automated forms of disambiguation are either not applicable or infeasible in a multilingual setting. For example, knowledge databases such as the one used by Liu et al. [37] are not available in many languages. Furthermore, handling web forum discourse with such knowledge databases can be less effective due to the forum-specific terminology and challenges associated with free text (e.g., misspelling, grammatical mistakes, etc.). Similarly Fuzzy Logic may not be highly accurate, particularly for shorter messages with fewer affect features (as are commonly found in web discourse). This is because the fuzzy semantic typing approach relies on the cumulative effect of the usage of related vocabulary to effectively represent a document’s affective content [11]. In contrast probabilistic models provide a simpler, more generic method for coping with ambiguity [38]. Our approach assigns each term/phrase a probability of being used in the proper context. This is done by selecting a sample number of occurrences of each affect feature and determining the number of times the feature appears in an unrelated/irrelevant context. For evaluation of intensity correlations, we propose the use of linear regression analysis. For temporal analysis of affect intensities, we propose the use of an information visualization technique specifically designed to illustrate affect usage intensities over time.

6.

SYSTEM DESIGN

Our system design has two major components: affect lexicon creation, and the analysis techniques that can be used to perform affect analysis. The affect lexicon creation component consists of several steps, including term list creation, intensity assignment, and probabilistic disambiguation. The analysis technique steps are affect parsing, intensity score computation, and affect intensity analysis, including intensity scores, correlation analysis, and

14. Analysis of Affect Intensities in Extremist Group Forums

295

intensity visualization. Figure 14-1 shows each of these steps in our affect analysis system design. Details of key steps are presented below.

Figure 14-1. Affect Analysis System Design

6.1 Affect Lexicon Creation 6.1.1 Term List Creation The affect term lists are manually created by inspecting messages using native speakers familiar with the forum content and web discourse terminology for each region. Such a manual term list creation approach has also been used in many previous studies [29]-[11]-[26]. Manual list creation is incorporated for a couple of reasons. Firstly, psycholinguistic databases such as those used by Anderson [39] only exist for English and do not feature many common racial and violent terms. Secondly, forums have their own terminology [40] which can be difficult to extract without manual evaluation of conversation text. This is particularly true for hate related terms, where a considerable amount of slang is involved. Hence, humans are better equipped to identify appropriate affect terms for web discourse. 6.1.2 Intensity Assignment Coders assign each term/phrase an intensity score. The scores are assigned based on the word’s degree of intensity or valence for its particular affect category. The intensity scores are on a scale of 1-20, with 20 signifying high intensity. This approach is consistent with the intensity score

296

Chapter 14. Abbasi & Chen

assignment methods incorporated in previous studies [29]-[11]-[26]. 6.1.3 Probabilistic Disambiguation Each affect feature is assigned an ambiguity score. The ambiguity score is the probability of an instance of the feature having semantic orientation congruence with the affect class represented by that feature. The ambiguity score for each feature is determined by taking a sample set of instances of the feature’s occurrence and coding each occurrence as to whether the term usage is relevant to its affect. A maximum of 20 samples is used per term. Using more instances would be exhaustive and we observed that using a maximum sample of this size was sufficient to accurately capture the probability of an affect being relevant. The ambiguity score can be computed as follows:

A( f ) =

cf sf

Equation 14-1

where:

A( f ) cf sf

ambiguity score for affect feature f; number of correctly appearing instances for affect feature f; total number of sampled instances for affect feature f;

6.2 Affect Analysis Techniques 6.2.1 Affect Parser The affect parser extracts the affect features from the message text. The parser is specifically designed for handling noisy text that appears in web discourse. It is able to detect and ignore duplicate posts, content forwarded multiple times and requoted messages. For Arabic, the parser also uses an elongation filter and an n-gram based morphological similarity detector (based on Dice’s equation) for capturing certain inflected forms of an affect feature that may have been omitted during the feature list creation phase [22]. After accounting for noise, the parser performs stemming and word tokenization and generates affect feature vectors which are used as input for the affect intensity and variation analysis. 6.2.2 Affect Intensity Scores The affect intensity score for an affect class across a set of messages can

14. Analysis of Affect Intensities in Extremist Group Forums

297

be computed as follows: k

n

I (c ) = å j =1

åI f =1

f

A f x fj n

Equation 14- 2

where: I (c) If Af x fj k n

intensity score for affect class c; intensity of affect feature f; ambiguity score for affect feature f; occurrence frequency of feature f in message j; total number of features in affect class c; total number of messages;

We used an additive intensity score approach [29]-[30] over an averaging one such as that used by Subasic & Huettner [11]. We believe that additional occurrences of an affect feature strengthen the overall affect intensity, especially when applied to affect classes such as racism and violence. For example, we believe that the phrase “I am going to beat and stab you” is more intense than the phrase “I am going to stab you.”

7.

EVALUATION

In this section we describe the research hypotheses and proposed experiments. The experiments are intended to evaluate our hypotheses and also demonstrate the effectiveness of our affect analysis approach in a multilingual web discourse setting. We propose performing affect analysis of extremist forums using our approach to assess the presence and trends pertaining to violence and hate related affects. The multilingual nature of extremist forums provides a good test bed for evaluating the efficacy of our approach. Additionally, there is a need to assess extremist forums to better understand the content and propaganda dissemination within these online communities.

7.1 Hypotheses For the affect intensity analysis, we wish to compare average affect intensity scores across forums and regions. For the intensity score comparison, we present the following hypothesis: H1a: There is no difference between U.S. and Middle Eastern forums in

298

Chapter 14. Abbasi & Chen

terms of hate affect intensity. H1b: There is no difference between U.S. and Middle Eastern forums in terms of violence affect intensity. For the affect intensity correlation analysis, we wish to assess the correlation between the violence and hate affect intensities. For the affect intensity correlation, we present the following hypothesis: H2a: There is no correlation between hate and violence affect usage in U.S forum messages. H2b: There is no correlation between hate and violence affect usage in Middle Eastern forum messages. For the affect variation analysis, we wish to compare the average variation scores for messages and over time. We present the following hypothesis: H3a: There is no difference between U.S. and Middle Eastern forums in terms of hate affect usage over time. H3b: There is no difference between U.S. and Middle Eastern forums in terms of violence affect usage over time.

7.2 Test Bed Extremist group forums were collected and extracted as part of the Dark Web project in the Artificial Lab at the University of Arizona [4]. This project involves spidering the web and collecting web sites and forums relating to hateful and extremist groups. In order to ensure the integrity of the collection, extremist group URLs are gathered from reputable sources including government reports (e.g., United Nations, intelligence agencies), research centers, and domain experts. These URLs are then used to gather additional relevant forums and web sites [21]. The test bed consists of messages from 16 U.S. and Middle Eastern forums taken from the Dark Web collection (shown in Table 14-3). All forums were taken from Yahoo, which has taken some heat in recent years for hosting hate and supremacist group forums [41]-[42]. Forums from the same web site were used to offset content variations attributable to web site structures as well as site/forum specific usage dynamics. For example, the use of serial versus threaded message structures can impact content, and specifically sentiment. Agrawal et al. [12] observed that linked messages (ones referencing another) in USENET threads tended to contain antagonistic sentiments. Efron [13] observed the opposite phenomenon for several discourse web sites, where linked sites shared sentiments. This suggests that different web artifacts may have their own content and interaction dynamics.

14. Analysis of Affect Intensities in Extremist Group Forums Table 14-3. Extremist Group Forum Test Bed U.S. Forum Authors Messages Angelic 28 78 Adolf Aryan 54 189 Nation CCNU 2 229 Neo-Nazi NSM

98 289

632 2654

Smash Nazi White Knights World Knights Total

10

66

24

751

35

77

540

4676

Forum Azzamy

299

Middle Eastern Authors Messages 60 337

Friends

119

339

Islamic Union Kataeb Kataeb Qassam Taybah

67

473

66 57

229 582

63

290

42

173

363

926

837

3349

Osama Lover Wa Islamah Total

7.3 Affect Lexicons The affect lexicon consisted of 4 affect term lists for violence and hate related terms in the U.S. and Middle Eastern forums. The total lexicon used was composed of over 200 unique entries reflecting different facets of the 2 affect classes selected in our analysis. The term lists for each affect class were generated manually and assigned intensities by coders familiar with the forum content. A pair of coders was used for each language and the intensity was taken as the average of the two coders’ assigned scores. Table 14-4. Violence Affect Lexicon Examples Term Description Intensity hit 5.50 beat 8.00 stab 11.50 hang 16.00 kill 17.00 lynch 20.00 ‫اﻟﺪم‬ ‫ﻗﺘﻞ‬ ‫اﻟﺬﺑﺢ‬ ‫ﺗﻔﺠﯿﺮ‬ ‫اﻟﻌﻤﻠﯿﺎت اﻻﺳﺘﺸﮭﺎدﯾﺔ‬

blood kill slaughter detonation martyrdom operation

4.00 17.00 15.50 18.00 20.00

Ambiguity 0.80 0.67 1.00 0.65 0.95 1.00

Weight 4.40 5.34 11.50 10.40 16.15 20.00

0.90 1.00 0.70 0.85 1.00

3.60 17.00 10.85 15.30 20.00

300

8.

Chapter 14. Abbasi & Chen

RESULTS

8.1 Affect Intensity Scores The affect intensity scores were computed for each forum as well as across all messages within a region. Table 14-5 shows the intensity scores for the racism and violence affects. In our first hypothesis H1, we postulated that there would be no difference in violence and hate related affect intensities across the two regions. The U.S forums have a significant amount of racism related content but less violence related affect intensity. Overall, the Middle Eastern forums’ intensity of hate affect per message is close to the U.S. forums (p=0.178). However, there is much more violent affect intensity in the Middle Eastern forums (p λ01 > λ00 = λ11). Since the Reuters-21578 document collection does not have cost information, we devised a heuristic for cost assignment. There is a cost involved in incorrect classification. Moreover, a higher cost is assigned to a false positive than a false negative. Particularly, the cost for misclassifying a confidential document is computed by:

[

]

if d i Î c j and c j = positive ì s, s + | c j | ïé ù å cos t (d i ) ï ú d i Îc j cos t (d i ) = íê ïê0, | number of negative documents | ú otherwise ú ïê û îë where,

æ N s = ln ç ç| c è j

ö ÷ ´ 100 | ÷ø

N is the total number of documents and | c j | is the number of documents belonging to the jth category. The total cost for misclassification is added to the cost of confidential documents (i.e., positive class) misclassified if a classifier is not able to predict any of the positive documents, in order to prevent the case that a low cost is simply achieved by ignoring the class with a low frequency. For example, suppose that there are 15 out of 10,000 documents belonging to the positive class. The cost assignment ensures that the total cost for misclassifying those 15 examples should be either equal to or higher than that of the remaining documents.3

3

For this case, the cost for false positive is

æ 10000 ö ÷ ´ 100 ) è 15 ø

650.229 ( = ç

and the sum of the cost for false positive is 9753.4. The cost of misclassification of a negative document is

0.9768 ( =

9751.1835 ) and the cost sums to 9753.348. 9985

Chapter 21. Seo & Sycara

464

5.2

Experimental Results

In our experiments we chose five out of the 67 selected categories of the Reuters-21578 dataset. The chosen five categories were considered as representative according to their category frequencies: small (“livestock” and “corn”), medium (“interest”), and large (“acq” and “earn”). 70% of the documents in a category were used as “training” and the remaining 30% documents were used for “testing”, respectively. Nine different classifiers were tested: LDA, LR, and SVMs, and the combination of those three classifiers with two methods for cost-sensitive learning: metacost and costing. A binary classifier was trained for each of the selected categories by considering the category as positive (i.e., documents that an employee needs to know) with the rest of the data as negative examples. We made use of the 4 LIBSVM and tested three different kernels, such as linear, polynomial, and Gaussian. The Gaussian kernel (i.e., width = 1 / max feature dimension) was chosen due to its best performance and the different cost factors were 5 assigned for C=10 ~ 100. Those values are chosen optimally by 10-fold cross validation. As mentioned earlier, the experimental results were primarily analyzed by “false positive,” “false negative,” and “cost.” The experimental procedure was as follows: first, pick one of five selected categories; second, assign the cost to each of documents according to its importance using the heuristic described in the previous section; third, train each of nine classifiers by training examples with cost; fourth compute three performance measures (i.e., false positive, false negative, and cost for incorrect classification).

4 5

http://www.csie.ntu.edu.tw/~cjlin/libsvm/ The cost of constraint violation is set to 100 if there are relatively small numbers of positive examples available. Otherwise it is set to about 10.

21. Addressing Insider Threat through Document Classification

465

466

Chapter 21. Seo & Sycara

Figure 21-3. Pairs of false positive (diagonally crossed bar) and false negative (empty bar) for five categories by nine different classifiers, which are numbered from the left to the right at the x-axis: 1: SVM, 2: SVM with costing, 3: SVM with metacost, 4: LR, 5: LR with costing, 6: LR with metacost, 7: LDA, 8: LDA with costing, and 9: LDA with metacost, respectively. From the top left, the results for “livestock,” “corn,” “interest,” “acq,” and “earn” are presented. The y-axis represents false positive rate and the false negative rate in the range of 0.0 to 1.0.

Figure 21-3 shows pairs of false positive and false negative for the five selected categories that resulted from classification by nine different classifiers. The x-axis represents the nine different classifiers and the y-axis represents the misclassification rate in the range of 0.0 to 1.0. Except for the “interest” category, LR with costing showed the best results that minimize

21. Addressing Insider Threat through Document Classification

467

false positive while holding false negative relatively low. In particular, for the “livestock” category, LR trained by only 18% training data (i.e., 1,781 out of 9,854 documents) resulted in 0% false positive and 2.8% false negative rate. For the costing, we carried out five different sampling trials for each category (i.e., 1, 3, 5, 10, and 15) and represented the trial with the best performance. For the “livestock” category, a newly generated distribution by 10 rejection sampling trials was used to achieve this result. Each re-sampled set has only about 178 documents. LDA with the costing showed the smallest error for the “interest” category that is comprised of 5.6% false positives and 4.5% false negatives. We believe that the rejection sampling generated a set of good representative samples of the original data collection so that two discriminative classifiers (i.e., LR and LDA) could converge to the optimal (performance) asymptote quickly, even with a small number of examples [Ng and Jordan, 2001]. Table 21-2. The costs for misclassification by nine different classifiers are presented. The values in bold face are the best for corresponding category. Methods SVM SVM (w/costing) SVM (w/mc) LR LR (w/costing) LR (w/mc) LDA LDA (w/costing) LDA (w/mc) Base line cost

Livestock (114) 13967 4035 ± 30

Corn (253) 66453 8851 ± 52

Interest (513) 54065 9058 ± 159

Acq (2448)

Earn (3987)

83141 40009 ± 252

108108 96007 ± 331

7147 ± 50

23596 ± 64

32011 ± 321

194165 ± 451 349080 606 ± 145

228612 ± 453 710631 2521 ± 191

35809 484 ± 11

32759 1333 ± 44

60031 29614 ± 110

34980 ± 35

32759 ± 79

60374 ± 154 124733 7301 ± 152

386859 ± 1185 591300 39354 ± 205

788819 ± 263 908690 41478 ± 159

2638 1461 ± 28

66453 6092 ± 89

40079 ± 57 42625

45778 ± 71 79084

8955 ± 157 139113

51789 ± 285 591357

54084 ± 244 1090498

Table 21-2 replicates the trend that the best classifier is a logistic regression with costing, in terms of the total cost for misclassification, which is the sum of the cost for false positive and false negative. The number in parenthesis next to the topic name in table 2 is the total number of text documents belonging to that category. For example, there are 114 text documents belonging to the “livestock” category. The results reported for the costing and the metacost are the average of 5 different runs. The bottom line entitled “base line cost” is the total cost for a category if a classifier classifies all the testing examples incorrectly (e.g., the misclassification cost

Chapter 21. Seo & Sycara

468

of a classifier for “livestock” will be 42,625 if the classifier classifies all incorrectly). For the “earn” category, LR with the costing caused only 0.002 out of the total cost (2,521 out of 1,090,498). For the remaining categories, the best-performer paid only less than 0.05 out of the total cost. From the comparison with error-minimizing classifiers, the costing proved its effectiveness in that it requires relatively small amount of training data for a better performance. For the “corn” category, LR with the costing, which only used 10% of the training data (i.e., 986 out of 9,854 documents) showed the best result in terms of the smallest loss (1,333 out of 79,084), zero false positive, and lower false negative rate (0.039). The LR classifier was trained by a sample set by three rejection sampling trials that is comprised of 458 positive and 528 negative examples. The expected cost is 1.1% of the total cost caused by incorrect confidential access control (i.e., misclassification). From the false positive perspective (zero false alarm), there is no leaking of confidential information. 39% false negative rate means that there would be 39 out of 1,000 valid requests to the confidential information that are mistakenly rejected. This inconveniences employees because they have to access particular information for their projects, but the system does not authorize their access requests. This trend holds good for the remaining four categories.

6.

CONCLUSION

In confidential access control based on the need-to-know principle, a false positive occurs when the system accepts a request that should not have been accepted whereas a false negative occurs when the system rejects a request that should have been accepted. For both errors, the system pays the cost for misclassification. From the security perspective, it is more tolerable to have an authorization process with a high false negative rather than one with a high false positive rate because the latter is a serious security problem since confidential information, which should not be revealed, can be accessed. In this chapter we present approaches to cost-sensitive classification for confidential access. We model the binary decision whether to reject or accept a document access request in a cost-sensitive learning framework, where the cost caused by incorrect classification for the request is different according to the relative importance of two types of error: false positive and false negative. In addition, we invented a cost assignment method that ensures that the cost of a false positive decision (i.e., accept an invalid request) is higher than that of the false negative one (i.e., reject a valid

21. Addressing Insider Threat through Document Classification

469

request). Finally we tested three different error-minimizing classification methods and their combination with two cost-sensitive wrappers. From the comparison of the cost-sensitive learning methods with the error-minimizing classification methods, we found that the costing with a logistic regression showed the best performance. In particular, it requires far less training data for much better results, in terms of the smallest cost paid, the lowest false positive rate, and the relatively low false negative rate. The smallest cost implies that it is expected to pay 1.1% of the total cost caused by incorrect confidential access control. The nearly zero false positive rate means that there is no leaking of confidential information. The classification algorithms were implemented in a guard agent that performed the automated classification and denied or permitted user access based on the classification of the request. Besides demonstrating costsensitivity and good computational performance compared to other methods, our approach has three important benefits for the domain of insider threat. First, the required training set is small. The benefit of smaller training data is two-fold; (a) obviously it takes less time to train the classifier; (b) it enables a human administrator to conveniently identify arbitrary subsets of confidential information, in order to train the initial classifier. In other words, through our proposed methods, it becomes easier for a human administrator to define, assign, and enforce an effective access control for a particular subset of confidential information. Second, our method allows an organization to flexibly set different costs for misclassification to reflect the organization’s tolerance for suspicious confidential access requests. Third, the implementation is flexible, allowing either monitoring of suspicious requests or outright denying those requests and notifying the user’s supervisors or security administrators. In addition, the system saves every suspicious request for audit trailing and alarms. Although our approach demonstrates promising results, we believe that such an automated content-based approach should be used as a complementary tool for a human administrator, not as a primary tool for confidential access authorization. Since no actual classified data are available, our experiments utilized a well-known dataset in a simulated confidential authorization scenario that primarily generates a dichotomous decision space. In particular, text documents belonging to one of the selected categories are regarded as positive to need-to-know confidential and the remaining documents are regarded as negative. Since an unclear (or overlapped) boundary between two classes is one of the reasons that allows most of security leaks (or classification errors), our experiments focused on discovering the classification method that is capable of identifying the boundary (i.e., minimizing error metrics). These unclear boundaries between positive and

Chapter 21. Seo & Sycara

470

negative examples are primarily caused by the usage of the same feature space (i.e., word set). In particular, documents under “livestock” and “corn” categories use a number of the same word features (e.g., tone, import, export, price, trader, report, and so on) to describe their contents because they are notionally belonging to the same category called “commodity” (same as “acq”, “earn”, and “interest” are “economic”) [Ankolekar et al., 2003]. Therefore the actual contents of documents used in experiments may or may not be the same as the true nature of confidential documents. Nevertheless, we believe our study is valuable to practitioners for two reasons. First, our approach is general and does not depend on any particular characteristics or structure of the data set. Second, we believe that our approach would work well for actual classified documents in practice because our methods were able to show promising results, for example good performance for the case of unclear boundary between positive and negative examples (e.g., “livestock” as positive and “corn” as negative class). However, it would be good for the organization that may want to apply the method in practice to conduct additional validation experiments with the actual data they would like to use. Such validations are necessary and are a general practice whenever research prototype methods are applied to real world situations.

7.

ACKNOWLEDGMENTS

This work was supported in part by a grant form ARDA through a subcontract of Computer Technology Associates, BAA-03-02-CMU, and in part by AFOSR contract number F49640-01-1-0542 to Carnegie Mellon University.

REFERENCES Aleman-Meza, B., Burns, P., Eavenson, M., Palaniswami, D., and Sheth, A., An ontological approach to the document access problem of insiders threat, In Proceedings of IEEE International Conference on Intelligence and Security Informatics (ISI-05), pp. 486-491, 2005. Ankolekar, A., Seo, Y.-W., and Sycara, K. Investigating semantic knowledge for text learning, In Proceedings of SIGIR-2003 Workshop on Semantic Web, pp. 9-17, 2003. Domingos, P., Metacost: A general method for making classifiers cost-sensitive, In Proceedings of International Conference on Knowledge Discovery and Data Mininig, pp. 154-164, 1999. Drummond, C. and Holte, R.C., Exploiting the cost (in)sensitivity of decision tree splitting criteria, In Proceedings of International Conference on Machine Learning (ICML-00), pp.

21. Addressing Insider Threat through Document Classification

471

239-246, 2000. Duda, R.O., Hart, P.E., Stork, D.G., Pattern Classification, Wiley-Interscience, 2001. Elkan, C., The foundations of cost-sensitive learning, In Proceedings of International Joint Conference on Artificial Intelligence (IJCAI-01), pp. 973-978, 2001 Fan, W., Stolfo, S.J., Zhang, J., and Chan, P.K., Adacost: Misclassification cost-sensitive boosting, In Proceedings of International Conference on Machine Learning (ICML-99), pp. 97-105, 1999. Fawcett, T., ROC graphs: Notes and practical considerations for researchers, HP Lab Palo Alto, HPL-2003-4, 2003. Giuri, L. and Iglio, P., Role templates for content-based access control, In Proceedings of ACM Workshop on Role Based Access Control, pp. 153-159, 1997. Lee, W., Miller, M., Stolfo, S., Jallad, K., Park, C., Zadok, E., and Prabhakar, V., Toward cost-sensitive modeling for intrusion detection, ACM Journal of Computer Society, Vol. 10, No. 1-2, pp. 5-22, 2002. Joachims, T., Text categorization with support vector machines: Learning with many relevant features, In Proceedings of European Conference on Machine Learning (ECML-98), 1998. Ng, A.Y. and Jordan, M.I., On discriminative vs. generative classifiers: A comparison of logistic regression and naïve Bayes, In Proceedings of Neural Information Processing Systems (NIPS-01), pp. 841-848, 2001. Seo, Y.-W., Giampapa, J., and Sycara, K., A multi-agent system for enforcing need-to-know security policies, In Proceedings of International Conference on Autonomous Agents and Multi-Agent Systems (AAMAS) Workshop on Agent Oriented Information Systems (AOIS04), pp. 163-179, 2004. Seo, Y.-W. and Sycara, K., Cost-sensitive access control for illegitimate confidential access by insiders, In Proceedings of IEEE Intelligence and Security Informatics (ISI-06), pp. 117-128, 2006. Schutze, H., Hull, D.A., Pedersen, J.O., A comparison of classifiers and document representations for the routing problem, In Proceedings of International ACM Conference on Research and Development in Information Retrieval (SIGIR-95), pp 229-237, 1995. Symonenko, S., Liddy, E.D., and Yilmazel, O., Semantic analysis for monitoring insider threats, In Proceedings of Symposium on Intelligence and Security Informatics, 2004. Torkkola, T., Linear discriminant analysis in document classification, In IEEE Workshop on TextMining, 2001. Weippl, E. and Ibrahim, K., Content-based management of document access control, In Proceedings of the 14th International Conference on Applications of Prolog, 2001. Zadrozny, B., Langford, J., and Abe, N., A simple method for cost-sensitive learning, Technical report, IBM Tech Report, 2002.

SUGGESTED READINGS · ·

For more information about (error-minimizing) classification and technical details on pattern classification, see Duda et al., 2001, and Mitchell, 1997: Mitchell, T.T., Machine Learning, McGraw-Hill, 1997. For more information about text classification, see Joachims, 1998, Ng and Jordan, 2001, Schutze et al., 1995, Torkkola, 2001, and Chapter 16, “Text Categorization,” in Manning and Schutze, 1999: Manning, C.D.

Chapter 21. Seo & Sycara

472

·

and Schutze, H., Foundations of Statistical Natural Language Processing, MIT Press, 1999. For more information about cost-sensitive classification, see Domingos, 1999, Elkan, 2001, Fan et al., 1999, and Zadrozny et al., 2002.

ONLINE RESOURCES · ·

· · ·

A companion site of the book “Foundations of Statistical Natural Language Processing”, http://www-nlp.stanford.edu/fsnlp/ Dawn Cappelli, Andrew Moore, and Timothy Shimeall, Common sense guide to prevention and detection of insider threats, US-CERT (a government organization), http://www.uscert.gov/reading_room/prevent_detect_insiderthreat0504.pdf Insider Threat Study by National Threat Assessment Center, http://www.secretservice.gov/ntac_its.shtml Eric D. Shaw, Keven G. Ruby, and Jerrold M. Post, The insider threat to information systems, http://www.dss.mil/training/csg/security/Treason/Infosys.htm Defending Against Insider-Threat Conference, http://www.homelanddefensejournal.com/conf_insider.htm

DISCUSSION QUESTIONS 1. This chapter presents a way to address illegitimate information access by malicious insiders. Can you think of additional ways to address this problem? 2. What are some additional aspects of insider threat? 3. Can you think of ways of addressing those additional insider threat aspects identified in 2 above? 4. Can you think of additional domains (besides security and medicine) and additional applications where cost sensitive classification is important?

22 USING WEB MINING AND SOCIAL NETWORK ANALYSIS TO STUDY THE EMERGENCE OF CYBER COMMUNITIES IN BLOGS Michael Chau1 and Jennifer Xu2 1

School of Business, The University of Hong Kong, Pokfulam, Hong Kong ([email protected]); 2Department of Computer Information Systems, Bentley College, Waltham, Massachusetts, U.S.A. ([email protected])

CHAPTER OVERVIEW Blogs have become increasingly popular in recent years. Bloggers can express their opinions and emotions more freely and easily than before.Many communities have emerged in the blogosphere, including racist and hate groups that are trying to share their ideology, express their views, or recruit new group members. It is imperative to analyze these cyber communities in order to monitor for activities that are potentially harmful to society. Web mining and social network analysis techniques, which have been widely used to analyze the content and structure of Web sites of hate groups on the Internet, have not been applied to the study of hate groups in blogs. In this research, we present a framework, which consists of components of blog spider, information extraction, network analysis, and visualization, to address this problem (Chau & Xu, 2007). We applied this framework to identify and analyze a selected set of 28 anti-Blacks hate groups on Xanga, one of the most popular blog hosting sites. Our analysis results revealed some interesting demographical and topological characteristics in these groups, and identified at least two large communities on top of the smaller ones. We suggest that our framework can be generalized and applied to blog analysis in other domains.

473

474

1.

Chapter 22. Chau & Xu

INTRODUCTION

Blog is a Web-based publication that allows users to add content easily and periodically, normally in reverse chronological order. Blogs have become increasingly popular in recent years, partly due to the availability of easy-to-use blogging tools and free blog hosting sites, such as www.blogger.com, www.xanga.com, and www.livejournal.com. These tools also support the linking to other pages or the posting of comments to blogs (Blood, 2004). Instead of having a few people in control of the discussion (like in traditional Internet forums), blogs basically allow anyone to express their ideas and thoughts freely in one’s own blog space. There are many communities in the blogosphere. These could be support communities such as those for technical support or educational support (Nardi et al., 2004), or groups of bloggers who already knew each other in other context, such as a group for a high school or a company. Moreover, there are also communities formed by people who share common interests or opinions. Many free blog hosting sites have the function to allow bloggers to link to each other to form explicit groups. Similar to other Web-based media such as Web sites, discussion forums, or chat rooms where hate groups are present (Anti-Defamation League, 2001; CNN, 1999; Glaser et al., 2002), there are also hate groups in blogs that are formed by bloggers who are racists or extremists. The consequences of the formation of such groups on the Internet cannot be underestimated. Hate groups or White supremacist groups like the Ku Klux Klan have started to use the Internet to spread their beliefs, recruit new members, or even advocate hate crimes with considerable success (Anti-Defamation League, 2001). The Web has allowed these groups to reach much further into society than ever before. Young people, the major group of bloggers, are more likely to be affected and even “brainwashed” by ideas propagated through the Web as a global medium. Hatred and extremism ideas could easily be embedded into their minds to make them become members of these hate groups or even conduct hate crimes. To investigate the cyber activities of hate groups in blogs, it is important to devise an efficient and effective way to identify these groups, extract the information of their members, and explore their relationships. In recent years, advanced techniques such as text mining, Web mining, and social network analysis have been widely used for cyber crime and terrorism analysis (e.g., Chen et al. 2004). For example, network analysis techniques have been used to study the relationships between extremist Web sites on the Internet (Zhou et al., 2005). However, the application of these techniques to blog analysis on the Web is a new area and no prior research has been published. We suggest that these techniques could be used to help identify and analyze hate groups on the Web, particularly in blogs. In this chapter, we

22. Using Web Mining & Social Network Analysis

475

present a semi-automated framework that combines blog spidering and social network analysis techniques to facilitate such analysis (Chau & Xu, 2007). The rest of the chapter is organized as follows. In Section 2 we review the research background of hate group analysis and related research in text mining, Web mining, and social network analysis. We pose our research questions in Section 3, and a semi-automated framework for hate group analysis in blogs is presented in Section 4. In Section 5 we present a case study that we have performed on a popular blog hosting site based on the proposed framework and discuss our analysis findings. Lastly, we conclude our research in Section 6 and suggest some directions for future work.

2.

RESEARCH BACKGROUND

In this section we will review the background of hate groups on the Web and in blogs. We also review relevant techniques in Web mining and social network analysis that have been applied in analyzing Web contents.

2.1

Cyberhate and Blogs

Hate crimes have been one of the long-standing problems in the United States because of various historical, cultural, and political reasons. It is reported that 60% of hate criminals are youths (Levin & McDevitt, 1993), who are, perhaps unfortunately, also one of the largest groups of Internet users. Hate groups have been increasingly using the Internet to express their ideas, spread their beliefs, and recruit new members (Lee & Leets, 2002). Glaser et al. (2002) suggest that racists often express their views more freely on the Internet. The Hate Directory (Franklin, 2005) compiles a list of hundreds of Web sites, files archives, newsgroups, and other Internet resources related to hate and racism. Several studies have investigated Web sites that are related to racism or White supremacy (e.g., Lee & Leets (2002); Gerstenfeld et al. (2003)). Burris et al. (2000) systematically analyzed the networks of Web sites maintained by white supremacist groups and found that this network had a decentralized structure. Zhou et al. (2005) used software to automate the analysis of the content of hate group Web sites and the linkage among them. They found that one of the major objectives of these Web sites was to share ideology. Online communities such as White Supremacists and NeoNazis were identified among these sites. In recent years, hate groups have emerged in blogs, where highlynarrative messages are popular. Blogs, also known as weblogs, have become increasingly popular since 2000. Weblog was first introduced in 1997 and in

476

Chapter 22. Chau & Xu

those early days, blogs were used mainly to designate pages where links to other useful resources were periodically “logged” and posted. At that time blogs were mostly maintained by hand (Blood, 2004). After easy-to-use blogging software became widely available in 1999 and early 2000, the nature of blogs has changed and many blogs are more like personal Web sites that contain various types of content (not limited to links) posted in reversechronological order. Bloggers often make a record of their lives and express their opinions, feelings, and emotions through writing blogs (Nardi et al., 2004). Many bloggers consider blogging as an outlet for their thoughts and emotions. Besides personal blogs, there are also blogs created by companies. For example, ice.com, an online jewelry seller, has launched three blogs and reported that thousands of people linked to their Web site from these blogs (Hof, 2005). One of the most important features in blogs is the ability for any reader to write a comment on a blog entry. On most blog hosting sites, it is very easy to write a comment, in a way quite similar to replying to a previous message in traditional discussion forums. The ability to comment on blogs has facilitated the interaction between bloggers and their readers. On some controversial issues, like those related to racism, it is not uncommon to find a blog entry with thousands of comments where people dispute back and forth on the matter. Any individual can create an account on a blog hosting site and start writing their blogs in minutes. According to Alexa (2005), Blogger (www.blogger.com) and Xanga (www.xanga.com) are the two most popular blog hosts. Both blog hosts are free to use and have their own characteristics. For example, Xanga supports subscriptions and groups (as blogrings) while Blogger has a nice search capability supported by Google. A screenshot of the first page of Xanga is shown in Figure 22-1. Users can log in their accounts from this page and edit their blogs. Alternatively, users can create new accounts or browse the blogs of other users. Cyber communities have also been formed in blogs. Communities in blogs can be categorized as explicit communities or implicit communities, like other cyber communities on the Web (Kumar et al., 1999). Explicit communities in blogs are the groups, or blogrings, that bloggers have explicitly formed and joined. Most blog hosting sites allow bloggers to form a new group or join any existing groups. On the other hand, implicit communities are not explicitly defined as groups or blogrings by bloggers. Instead, these communities are identified by the interactions among bloggers, such as subscription, linking, or commenting. For example, a blogger may subscribe to another blog, meaning that the subscriber can get updates when the subscribed blog has been updated. A blogger can also post a link and add a comment to another blog, which are perhaps the most traditional activities

22. Using Web Mining & Social Network Analysis

477

among bloggers. These interactions signify some kind of connection between two bloggers. Similar to the analysis of hyperlinks among Web pages to identify communities (Chau et al., 2005; Chau et al., 2007), the analysis of these types of connections between bloggers could also identify cyber communities and their relationships.

Figure 22-1. The hompage of Xanga

2.2

Web Mining and Social Network Analysis

In recent years, Web mining techniques have been widely adopted from data mining, text mining, and information retrieval research and applied to various domains. Web mining research can be classified into three categories: Web content mining, Web structure mining, and Web usage mining (Kosala & Blockeel, 2000; Chen & Chau, 2004). Web content mining refers to the discovery of useful information from Web contents, including text, images, audio, video, etc. Web content mining research includes resource discovery from the Web, document categorization and clustering, and information extraction from Web pages. Web structure mining studies the model underlying the link structures of the Web. It usually involves the analysis of in-links and out-links information of Web pages, and has been used for

478

Chapter 22. Chau & Xu

search engine result ranking and other Web applications. Google’s PageRank (Brin & Page, 1998) and HITS (Kleinberg, 1998) are the two most widely used algorithms. Web usage mining focuses on using data mining techniques to analyze search logs or other activity logs to find interesting patterns. One of the main applications of Web usage mining is its use to learn user profiles. In Web mining research, Web spiders have been widely used to traverse the Web and collect Web pages for further analysis. Spiders, also known as crawlers, wanderers, or Webbots, are defined as “software programs that traverse the World Wide Web information space by following hypertext links and retrieving Web documents by standard HTTP protocol” (Cheong, 1996). Since the early days of the Web, spiders have been widely used to build the underlying databases of search engines, to perform personal search, to archive particular Web sites or even the whole Web, or to collect Web statistics. Chau and Chen (2003) provide a review of Web spider research. Various methods have been proposed in Web structure mining research to identify Web communities (Gibson et al., 1998; Kumar et al., 1999). Many of these methods are rooted in the HITS algorithm (Kleinberg, 1998). Kumar et al. (1999) propose a trawling approach to find a set of core pages containing both authoritative and hub pages for a specific topic. The core is a directed bipartite subgraph whose node set is divided into two sets with all hub pages in one set and authoritative pages in the other. The core and the other related pages constitute a Web community (Gibson et al., 1998). Treating the Web as a large graph, the problem of community identification can also be formulated as a minimum-cut problem, which finds clusters of roughly equal sizes while minimizing the number of links between clusters (Flake et al., 2000; Flake et al., 2002). Realizing that the minimum-cut problem is equivalent to the maximum-flow problem, Flake et al. (2000) formulate the Web community identification problem as an s-t maximum flow problem, which can be solved using efficient polynomial time methods. Hierarchical clustering methods have also been proposed to partition networks, especially unweighted networks such as the Web in which hyperlinks do not have associated weights (e.g., Radicchi et al., 2004). On the other hand, a recent movement in statistical analysis of network topology (Albert & Barabási, 2002) has brought new insights and research methodology to the study of network structure. Networks, regardless of their contents, are classified into three categories: random network (Bollobás, 1985), small-world network (Watts & Strogatz, 1998), and scale-free network (Barabási & Alert, 1999). In a random network the probability that two randomly selected nodes are connected is a constant p. As a result, each node has roughly the same number of links. In addition, communities are not likely to exist in random networks. Small-world networks, in contrast, have a

22. Using Web Mining & Social Network Analysis

479

significantly high tendency to form groups and communities. Most empirical networks including social networks, biological networks, and the Web have been found to be nonrandom networks. In addition, many of these networks are also scale-free networks (Barabási & Alert, 1999), in which a large percentage of nodes have just a few links, while a small percentage of the nodes have a large number of links. Thus, nodes in scale-free networks are not homogenous in terms of their links, and some nodes become hubs or leaders that play important roles in the functioning of the network. The Web has been found to have both small-world and scale-free properties (Albert & Barabási, 2002). Researchers have been employing social network analysis methods to analyze the structure of the Web (Kumar et al., 2002). Social network analysis (SNA) is a sociological methodology for analyzing patterns of relationships and interactions between social actors in order to discover the underlying social structure (Wasserman & Faust, 1994). Not only the attributes of social actors, such as their age, gender, socioeconomic status, and education, but also the properties of relationships between social actors, such as the nature, intensity, and frequency of the relationships, are believed to have important implications to the social structure. SNA methods have been employed to study organizational behavior, inter-organizational relations, citation patterns, computer mediated communication, and many other areas. Recently, SNA has also been used in the intelligence and security domain to analyze criminal and terrorist networks (Krebs, 2001; Xu & Chen, 2004; 2005). When used to mine a network, SNA can help reveal the structural patterns such as the central nodes which act as hubs, leaders, or gatekeepers, the densely-knit communities or groups in which nodes have frequent interactions with each other, and the patterns of interactions between the communities and groups. These patterns often have important implications. For example, the central nodes often play a key role by issuing commands or bridging different communities. The removal of central nodes can disrupt a network more effectively than peripheral nodes (Albert et al., 2000).

3.

RESEARCH QUESTIONS

We believe that it is an important and timely issue to identify the hate groups in blogs and analyze their relationships. Web mining and network analysis techniques have been used to analyze Web content such as Web pages and hyperlinks; however, we have not been able to identify any prior research on blogs in this aspect in the literature. Based on our review, we pose the following research questions: (1) Can we use a semi-automatic framework to identify hate groups in blogs? (2) What is the pattern of inter-

480

Chapter 22. Chau & Xu

action between bloggers in hate groups? (3) Can social network analysis techniques be used to analyze the groups and their relationships in blogs?

4.

A FRAMEWORK FOR BLOG COLLECTION AND ANALYSIS

In this section, we present a semi-automated framework for identifying groups and analyzing their relationships in blogs (Chau & Xu, 2007). The framework is diagrammed in Figure 22-2. Our framework consists of four main modules, namely Blog Spider, Information Extraction, Network Analysis, and Visualization. The Blog Spider module downloads blog pages from the Web. These pages are then processed by the Information Extraction module. Data about these bloggers and their relationships are extracted and passed to the Network Analysis module for further analysis. Finally the Visualization module presents the analysis results to users in a graphical display. In the following, we describe each module in more detail.

Figure 22-2. A semi-automated framework for blog link analysis

4.1

Blog Spider

A blog spider program is first needed to download the relevant pages from the blogs of interest. Similar to general Web fetching, the spider can

22. Using Web Mining & Social Network Analysis

481

connect to blog hosting sites using standard HTTP protocol. After a blogring description page or a blog page is fetched, URLs are extracted and stored into a queue. However, instead of following all extracted links, the blog spider should only follow links that are of interest, e.g., links to a group’s members, other bloggers, comment links, and so on. Links to other external resources are often less useful in blog analysis. In addition, the spider can use RSS and get notification when the blog is updated. However, this is only necessary when monitoring or incremental analysis is desired.

4.2

Information Extraction

After the blog pages have been downloaded, information extraction can be performed. This includes information related to the blog or the blogger, such as user profiles and dates of creation. This can also include linkage information between two bloggers, such as linkage, commenting, or subscription. Because different blogs may have different formats, it is not a trivial task to extract the user profiles, links, comments, and other useful information from blogs. Even blogs hosted on the same hosting site could have considerably different formats as they can be easily customized by each blogger. Pattern matching or entity extraction techniques can be applied. The information extracted can be stored into database for further analysis. Links extracted can be passed back to the blog spider for further fetching.

4.3

Network Analysis

Network analysis is a major component in our framework. In this module we propose three types of analysis: topological analysis, centrality analysis, and community analysis. The goal of topological analysis is to ensure that the network extracted based on links between bloggers is not random and it is meaningful to perform the centrality and community analysis. We use three statistics that are widely used in topological studies to categorize the extracted network (Albert & Barabási, 2002): average shortest path length, clustering coefficient, and degree distribution. Average path length is the mean of the all-pair shortest path lengths in a network. It measures the efficiency of communication between nodes in a network. Clustering coefficient indicates how likely nodes in a network form groups or communities. The degree distribution, p(k), is the probability that a node has exactly k links. Another measure related to average path length is the network’s global efficiency, which is defined as the average of the inverses of shortest path lengths over all pairs of nodes in a network (Crucitti et al., 2003).

482

Chapter 22. Chau & Xu

Centrality analysis follows the topological analysis if the extracted network is shown to be a nonrandom network in which node degrees may vary greatly. The goal of centrality analysis is to identify the key nodes in a network. Three traditional centrality measures can be used: degree, betweenness, and closeness (Freeman, 1979). Degree measures how active a particular node is. It is defined as the number of direct links a node has. “Popular” nodes with high degree scores are the leaders, experts, or hubs in a network. In the intelligence and security context, the removal of these key nodes in a criminal or terrorist network is often an effective disruptive strategy (Sparrow, 1991). Betweenness measures the extent to which a particular node lies between other nodes in a network. The betweenness of a node is defined as the number of geodesics (shortest paths between two nodes) passing through it. Nodes with high betweenness scores often serve as gatekeepers and brokers between different communities. They are important communication channels through which information, goods, and other resources are transmitted or exchanged (Wasserman & Faust, 1994). Closeness is the sum of the length of geodesics between a particular node and all the other nodes in a network. A node with low closeness may find it very difficult to communicate with other nodes in the network. Such nodes are thus more “peripheral” and can become outliers in the network (Sparrow, 1991; Xu & Chen, 2005). Community analysis is to identify social groups in a network. In SNA a subset of nodes is considered a community or a social group if nodes in this group have stronger or denser links with nodes within the group than with nodes outside of the group (Wasserman & Faust, 1994). An unweighted network can be partitioned into groups by maximizing within-group link density while minimizing between-group link density. In this case, groups are densely-knit subsets of the network. Note that community and groups here do not refer to the explicit groups (blogrings). They refer to a subset of nodes which form implicit clusters through various relationships, even if these nodes do not belong to the same explicit group. After a network is partitioned into groups, the between-group relationships become composites of links between individual nodes. In SNA, a method called blockmodeling is often used to reveal the patterns of interactions between groups (White et al., 1976). Given groups in a network, blockmodel analysis determines the presence or absence of a relationship between two groups based on the link density (Wasserman & Faust, 1994). When the density of the links between the two groups is greater than a predefined threshold value, a between-group relationship is present, indicating that the two groups interact with each other constantly and thus have a strong relationship. By this means, blockmodeling summarizes individual relational details into relationships between groups so that the overall structure of the network becomes more prominent.

22. Using Web Mining & Social Network Analysis

4.4

483

Visualization

The extracted network and analysis results can be visualized using various types of network layout methods. Two examples are multidimensional scaling (MDS) and graph layout approaches. MDS is the most commonly used method for social network visualization (Freeman, 2000). It is a statistical method that projects higher-dimensional data onto a lower-dimensional display. It seeks to provide a visual representation of proximities (dissimilarities) among nodes so that nodes that are more similar to each other are closer on the display and nodes that are less similar to each other are further apart (Kruskal & Wish, 1978). Various graph layout algorithms, such as the force-directed method, have been developed particularly for drawing aesthetically pleasing network presentations (Fruchterman & Reingold, 1991).

5.

A CASE STUDY ON XANGA

5.1

Focus and Methods

We applied our framework to perform a case study on hate groups in blogs (Chau & Xu, 2007). We chose to study the hate groups against Blacks because of two reasons. First, the nature of hate groups and hate crimes is often dependent on the target “hated” group. By focusing on a type of hate groups it is possible to identify relationships that are more prominent. Second, among different hate crimes, anti-Black hate crimes have been one of the most widely studied. This allows us to compare our results with previous research in the literature. We limited our study to blogs on Xanga (www.xanga.com). We chose Xanga over Blogger because Xanga has more prominent features to support subscriptions and groups (as blogrings). These features are useful for the identification of hate groups in the blogs and the relationships between bloggers. Also, it has been suggested that apparently more hate blogs exist in Xanga than in Blogger (Franklin, 2005). After choosing our focus, we identified a set of hate groups in Xanga. We used the search feature in Xanga to semi-automate the task. First, a set of terms related to Black-hatred, such as “KKK”, “niggers”, “white pride”, were identified. We used these terms to search in Xanga for groups (blogrings) that have any of these words in their group name or description. We then checked these groups and filtered out those not related to antiBlack. Groups with only one single member, which were often formed by one blogger but no one else had joined afterwards, were also removed from our list. This resulted in a set of 40 groups. While most of these groups

484

Chapter 22. Chau & Xu

showed some beliefs of racism or White supremacies, we tried to further narrow these down to groups that demonstrated explicit hatred, so as to make sure that our analysis focused on “hate groups”. So, we then manually checked these groups and only included those that explicitly mentioned hatred (e.g., “I hate black people”, “hate the black race”) or used offensive languages (e.g., “nigger beaters”, four-letter words) towards the Blacks in their group name or description. Finally we had a list of 28 groups. The list of the 28 groups is provided in the Appendix. Spiders were used to automatically download the description page and member list of each of these groups. A total of 820 bloggers were identified from these 28 groups. The spiders then further downloaded the blogs of each of these bloggers. The extraction program was then executed to extract the information from each blogger, including user id, real name, date of creation, date of birth, city, state, and country. One should note that these data were self-reported; they could be fraud or even missing. The extraction program also analyzed the relationship between these bloggers. In this study, two types of relationships were extracted: (1) Group co-membership: two bloggers belong to the same group (blogring). This is an undirected relationship with an integer weight (based on the number of groups shared by the two bloggers). As using all co-membership links would result in a very large network that corresponds to the original blogring information, we only included links whose weights are at least 2. (2) Subscription: blogger A subscribes to blogger B. This is a directed, binary relationship.

5.2

Analysis

After collecting the blogs and extracting information from them, we performed demographical and network analysis on the data set in order to reveal the characteristics of these groups and study whether any patterns exist. Visualization was also applied to present the results. We discuss the details of our analysis in the following subsections. 5.2.1

Demographical Analysis

We provide a brief summary of the demographical information of the bloggers of interest and the growth patterns of the blog space of hate groups. As in many other Internet-based media such as forums and chat rooms, the real identities of bloggers are unknown. Thus, the self-reported demographical information of bloggers is also subject to the problems of anonymity. However, since blogs are often personal online diaries many bloggers still choose to release partial information about their demographics such as gen-

22. Using Web Mining & Social Network Analysis

485

der and country. Six hundred and fifty-nine bloggers out of the 820 in our data set have explicitly indicated their gender. Sixty three percent of them are male and 37% female. These bloggers are from various countries, with 81.9% from the United States and the remaining 18.1% from other 45 countries. It can be seen that hate groups are dominated by male bloggers from the United States. However, one should note that this finding is based on the problematic source of demographic information. We also analyzed the growth of the hate group blogs over the years since their inception at Xanga in 2002. Unlike demographical information, the exact time when a blogger registered on Xanga is recorded by the server and thus is generally not subject to fraud. We found that the number of “hate” bloggers increased steadily between 2003 and the third quarter of 2004. The number has fluctuated since the forth quarter of 2004. This may be because some bloggers who have recently registered have not joined those popular blogrings or have not formed large communities. As a result, some of them were not included in the data set after we filtered the raw data. The finding suggests that as blogs become popular in general, hate groups have also been gaining popularity in blog space over years. Such a trend should not be underestimated because the ideas, beliefs, and opinions advocated by racists and extremists may pose potential threats to the society. 5.2.2

Topological Analysis

When analyzing the topology of the network, we ignored the weight of co-membership relationship and the direction of subscription. We connected two nodes if they belonged to at least two common groups or one subscribed to the other. So, there could only be at most one link between a pair of nodes. The resulting network was an unweighted, undirected network consisting of 1193 links. This network was not a connected graph in that it consisted of several disjoint components, between which no link existed. The largest connected component, often called a giant component in graph theory (Bollobás, 1985), contained 273 nodes connected by 1115 links. This giant component was a rather dense graph with an average node degree of 8.2. Table 22-1. The topological properties of the giant component (number in the parentheses are standard deviations) Average Shortest Global Efficiency Clustering Coefficient Path Length Giant Compo3.62 0.33 0.37 nent Random 2.89 (0.03) 0.37 (0.00) 0.03 (0.00) Counterpart

486

Chapter 22. Chau & Xu

We performed topological analysis for the giant component. Table 22-1 provides the statistics of the average shortest path length, global efficiency, and clustering coefficient. To compare the giant component with its random graph counterpart, we generated 30 random networks consisting of the same number of nodes (273) and links (1115) with the giant component. The resulting statistics are also reported in Table 22-1. It shows that the giant component is less efficient than its random graph counterpart. On average, a node in the giant component must take 0.75 more steps than in the random graph to reach another arbitrary node. Accordingly, the global efficiency of the giant component is also relatively low. However, the giant component has a significantly higher clustering coefficient, which is 31 times more than its random graph counterpart. This implies that the giant component is a small-world, in which densely-knit communities are very likely to exist. The degree distribution of the giant component also seems to follow a power-law distribution, meaning the network has a scale-free structure (see Figure 22-3). The most distinctive feature of a power-law distribution curve is its long tail for large degrees (k), which is significant different from a bellshaped Poisson distribution. The long tail indicates that a small number of nodes in the network have a large number of links and they are the key nodes to identify. A pure power-law distribution, p(k) ~ k-γ, appears as a straight line in logarithmic scale.

1 1

10

100

P(k)

0.1

0.01

0.001 Degree (k)

Figure 22-3. The scatter plot of the degree distribution of the giant component in logarithmic scale. The dashed straight line is the fitted power-law degree distribution, p(k) ~ k-γ, with γ = 1.29.

22. Using Web Mining & Social Network Analysis 5.2.3

487

SNA and Visualization

We performed centrality and community analysis using a prototype system we developed (Xu & Chen, 2005). The system has a graphical user interface to facilitate the interaction between users and the system (see Figure 22-4). The user interface visualizes the network and presents the results of social network analysis. In the visualization, each node represents a blogger. A straight line connecting two nodes indicates that either the two corresponding are co-members in more than one blogring, or one blogger subscribes to the other. The layout of the network is determined using the MDS method. In order to position nodes which are likely to belong to the same community close to each other on the display, we assigned each link an “edge clustering coefficient”, which measures the likelihood of two incident nodes of the link to form a cluster (Radicchi et al., 2004). The community analysis can be performed by adjusting the “level of abstraction” slider at the bottom of the panel. At the lowest level of abstraction, each individual node and link are presented. As the abstraction level increases, the system employs hierarchical clustering method to gradually merge nodes, which are connected by links of high edge clustering coefficients. When the highest abstraction level is reached, the whole giant component becomes a big community. At any level of abstraction, a circle represents a community. The size of the circle is proportional to the number of bloggers in the community. Straight lines connecting circles represent between-group relationships, which are extracted using blockmodel analysis. The thickness of a line is proportional to the density of the links between the two corresponding communities. Figure 22-4 presents the giant component at its lowest abstraction level. The bloggers who have the highest degree and betweenness scores are highlighted and labeled with their usernames. These bloggers are those who may participate in multiple blogrings or have many subscription relationships with other bloggers. It is interesting to see from this figure that in addition to joining explicit groups (blogrings), bloggers have also formed implicit communities through co-membership and subscription. Three circles of nodes are apparently communities in which bloggers share many common memberships. Because the communities can be analyzed at different levels, a big community may consist of smaller communities. Our analysis found two communities at the 70% abstraction level (not shown in Figure 22-4). We drew two dashed circles in Figure 22-4 to roughly represent the two communities. It shows that the bigger community consists of two smaller circles of nodes,

488

Chapter 22. Chau & Xu

which may also be communities. In addition, a blogger who ranks the highest in degree in the community would likely be the leader of the community. Also, bloggers with a high in-degree would be those who can disseminate their ideas and opinions through their blogs easily to many subscribers. These “leader” bloggers are the ones who should be substantially monitored by authorities which hope to regulate the activities of hate groups in blogs.

Figure 22-4. The prototype system for SNA and visualization, showing the giant component with both co-membership and subscription links. The highlighted nodes are those who have large degree or betweenness scores.

6.

CONCLUSION AND FUTURE DIRECTIONS

In this chapter, we have discussed the problems of the emergence of hate groups and racism in blogs. We have presented a semi-automated framework for blog analysis, and applied this framework to investigate the characteristic and structural relationships among the hate groups in blogs. We believe that

22. Using Web Mining & Social Network Analysis

489

this research is important to the security of society. By disseminating both explicit and implicit hatred messages through blogs, racists can easily target youths with a ubiquitous coverage – basically anyone who has access to the Internet – that was never possible in the past. Youths are often easily influenced by these messages and could eventually become terrorists and pose a threat to our society (Blazak, 2001). Our study has provided a framework that could facilitate the analysis of law enforcement and social workers in studying and monitoring such activities. While the framework has been studied in the context of hate group analysis, we have tried to keep the framework general such that it is not specific to such analysis. We believe that the framework can also be applied to other content and network analysis research that involves blog mining, which we believe would be an increasingly important field for various applications. These applications include not only other security informatics research but also applications in other domains such as marketing analysis and business intelligence analysis (Chau et al., 2005). We are extending our study in two major directions. First, the current study only investigated the hate group activities on one single blog site, Xanga. Although Xanga has been reported to have the most number of blogs associated with hate groups (Franklin, 2005), a further study that includes other popular sites such as Blogger would be more comprehensive. Second, only two types of relationships, namely co-membership and subscription, were considered in the present study. It would be interesting to expand our study to include other types of relationships, such as commenting and hyperlinking, in the network analysis. Inclusion of these relationships could reveal other implicit linkages among the bloggers.

7.

ACKNOWLEDGEMENTS

This research has been supported in part by a grant from the University of Hong Kong Seed Funding for Basic Research, “Searching and Analyzing Blogs for Competitive Advantages,” 10206775 (PI: M. Chau), January 2006 – December 2007. We would like to thank Porsche Lam and Boby Shiu of the University of Hong Kong for their participation and support in this project.

REFERENCES Albert, R. & Barabási, A.-L. (2002). Statistical Mechanics of Complex Networks. Reviews of Modern Physics 74(1), 47-97.

490

Chapter 22. Chau & Xu

Albert, R., Jeong, H., Barabási, A.-L. (2000). Error and Attack Tolerance of Complex Networks. Nature 406, 378-382. Alexa (2005). Top English Language Sites. [Online] Retrieved from http://www.alexa.com/site/ds/top_sites?ts_mode=lang&lang=en on October 7, 2005. Anti-Defamation League (2001). Poisoning the Web: Hatred Online. [Online] Retrieved from http://www.adl.org/poisoning_web/poisoning_toc.asp on October 7, 2005. Barabási, A.-L., Albert, R., & Jeong, H. (1999). Mean-Field Theory for Scale-Free Random Networks. Physica A 272, 173-187. Blazak, R. (2001). White Boys to Terrorist Men: Target Recruitment of Nazi Skinheads. American Behavioral Scientist 44(6), 982-1000. Blood, R. (2004). How Blogging Software Reshapes the Online Community. Communications of the ACM 47(12), 53-55. Bollobás, B. (1985). Random Graphs. London, Academic. Brin, S. & Page, L. (1998). The Anatomy of a Large-Scale Hypertextual Web Search Engine. Proceedings of the 7th WWW Conference, Brisbane, Australia, April 1998. Burris, V., Smith, E., & Strahm, A. (2000). White Supremacist Networks on the Internet. Sociological Focus 33(2), 215-235. Chau, M. & Chen, H. (2003). Personalized and Focused Web Spiders, in N. Zhong, J. Liu, & Y. Yao (Eds), Web Intelligence, Springer-Verlag, 197-217. Chau, M., Shiu, B., Chan, I., & Chen, H. (2005). Automated Identification of Web Communities for Business Intelligence Analysis, in Proceedings of the Fourth Workshop on EBusiness (WEB 2005), Las Vegas, USA, December, 2005. Chau, M., Shiu, B., Chan, I., & Chen, H. (2007). Redips: Backlink Search and Analysis on the Web for Business Intelligence, Journal of the American Society for Information Science and Technology 58(3), 351-365. Chau, M. & Xu, J. (2007). Mining Communities and Their Relationships in Blogs: A Study of Online Hate Groups, International Journal of Human-Computer Studies 65(1), 57-70. Chen, H. and Chau, M. (2004). Web Mining: Machine Learning for Web Applications, Annual Review of Information Science and Technology 38, 289-329, 2004. Chen, H., Chung, W., Xu. J., Wang, G., Qin, Y., & Chau, M. (2004). Crime Data Mining: A General Framework and Some Examples. IEEE Computer 37(4), 50-56. Cheong, F. C. (1996). Internet Agents: Spiders, Wanderers, Brokers, and Bots. Indianapolis, Indiana, USA: New Riders Publishing. CNN (1999). Hate Group Web Sites on the Rise, CNN News [Online] Retrieved from http://edition.cnn.com/US/9902/23/hate.group.report/index.html on October 7, 2005. Crucitti, P., Latora, V., Marchiori, M., & Rapisarda A. (2003). Efficiency of Scale-Free Networks: Error and Attack Tolerance. Physica A 320, 622-642. Flake, G. W., Lawrence, S., & Giles, C. L. (2000). Efficient Identification of Web Communities. In Proceedings of the 6th International Conference on Knowledge Discovery and Data Mining (ACM SIGKDD 2000), Boston, MA. Flake, G. W., Lawrence, S., Giles, C. L., & Coetzee, F. M. (2002). Self-Organization and Identification of Web Communities. IEEE Computer 35(3), 66-71. Franklin, R. A. (2005). The Hate Directory [Online] Retrieved from http://www.bcpl.net/~rfrankli/hatedir.htm on October 7, 2005. Freeman, L. C. (1979). Centrality in Social Networks: Conceptual Clarification. Social Networks 1, 215-240. Freeman, L. C. (2000). Visualizing Social Networks. Journal of Social Structure 1(1). Fruchterman, T. M. J. & Reingold, E. M. (1991). Graph Drawing by Force-Directed Placement. Software-Practice & Experience 21(11), 1129-1164.

22. Using Web Mining & Social Network Analysis

491

Gerstenfeld, P. B., Grant, D. R., & Chiang, C. P. (2003). Hate Online: A Content Analysis of Extremist Internet Sites. Analyses of Social Issues and Public Policy 3, 29-44. Gibson, D., J. Kleinberg, & Raghavan, P. (1998). Inferring Web Communities from Link Topology. In Proceedings of the 9th ACM Conference on Hypertext and Hypermedia, Pittsburgh, PA. Girvan, M. & Newman, M. E. J. (2002). Community Structure in Social and Biological Networks. Proceedings of the National Academy of Science of the United States of America 99, 7821-7826. Glaser, J., Dixit, J., & Green, D. P. (2002). Studying Hate Crime with the Internet: What Makes Racists Advocate Racial Violence? Journal of Social Issues 58(1), 177-193. Hof, R. (2005). Blogs on Ice: Signs of a Business Model? Business Week Online – The Tech Beat, June 2, 2005. [Online] Retrieved from http://www.businessweek.com/ the_thread/techbeat/archives/2005/06/ blogs_on_ice_si.html on October 7, 2005. Kleinberg, J. (1998). Authoritative Sources in a Hyperlinked Environment, in Proceedings of the 9th ACM-SIAM Symposium on Discrete Algorithms, San Francisco, California, USA, Jan 1998, pp. 668-677. Kosala, R. & Blockeel, H. (2000). Web Mining Research: A Survey. ACM SIGKDD Explorations 2(1), 1-15. Krebs, V. E. (2001). Mapping Networks of Terrorist Cells. Connections 24(3), 43-52. Krupka, G. R. & Hausman, K. (1998). IsoQuest Inc.: Description of the NetOwlTM extractor system as used for MUC-7, in Proceedings of the Seventh Message Understanding Conference, April 1998. Kruskal, J. B. & Wish, M. (1978). Multidimensional Scaling. Beverly Hills, CA, Sage Publications. Kumar, R., Raghavan, P., Rajagopalan, S., & Tomkins, A. (1999). Trawling the Web for Emerging Cyber-Communities. Computer Networks 31(11-16), 1481-1493. Kumar, R., Raghavan, P., Rajagopalan, S., & Tomkins, A. (2002). The Web and Social Networks. IEEE Computer 35(11), 32-36. Lee, E., & Leets, L. (2002). Persuasive Storytelling by Hate Groups Online: Examining Its Effects on Adolescents. American Behavioral Scientist 45, 927-957. Levin, J., & McDevitt, J. (1993). Hate crimes: The Rising Tide of Bigotry and Bloodshed. New York: Plenum. Nardi, B. A., Schiano, D. J., Gumbrecht, M., & Swartz, L. (2004). Why We Blog. Communications of the ACM 47(12), 41-46 Radicchi, F., Castellano, C., Cecconi, F., Loreto, V., & Parisi, D. (2004). Defining and Identifying Communities in Networks. Proceedings of the National Academy of Science of the United States of America, 101, 2658-2663. Sparrow, M. K. (1991). The Application of Network Analysis to Criminal Intelligence: An Assessment of the Prospects. Social Networks 13, 251-274. Wasserman, S. & Faust, K. (1994). Social Network Analysis: Methods and Applications. Cambridge, Cambridge University Press. Watts, D. J. & Strogatz, S. H. (1998). Collective Dynamics of ‘Small-World’ Networks. Nature 393, 440-442. White, H. C., Boorman, S. A., & Breiger, R. L. (1976). Social Structure from Multiple Networks: I. Blockmodels of Roles and Positions. American Journal of Sociology 81, 730780. Xu, J. J. & Chen, H. (2004). Fighting Organized Crime: Using Shortest-Path Algorithms to Identify Associations in Criminal Networks. Decision Support Systems 38(3), 473-487.

492

Chapter 22. Chau & Xu

Xu, J. J. & Chen, H. (2005). CrimeNet Explorer: A Framework for Criminal Network Knowledge Discovery. ACM Transactions on Information Systems 23(2), 201-226. Zhou, Y., Reid, E., Qin, J., Chen, H., & Lai, G. (2005). US Domestic Extremist Groups on the Web: Link and Content Analysis. IEEE Intelligent Systems 20(5), 44-51.

APPENDIX The list of the 28 groups analyzed in this study: Group Name

Xanga Group ID*

! ! ! !Hatred 4 SoCiEtY! ! ! !

709048

! White Power !

76863

** WHITE POWER NATION **

1298240

**~I Hate negros~**

1470409

::White::Power::

261285

`*~NEGRO HATERS~*`

325247

aLL NiGgErS sTiNk

107296

Angry and White

258062

are u racist? hate queers and niggers? me too.

191887

Black Haters and Negro Hangers

1401428

Dj aNDIE

794267

Honor+The+Ku+Klux+Klan

323614

I HATE BLACK PEOPLE

525845

I hate G-Unit

916827

I HATE N1GGERS

1733297

I HATE THE FREAKIN PORCH MONKEYS

1066584

K.K.K. MEMBERS

1447382

KKK WE GONNA KILL THE NIGGERS!!!

250810

KKK white is right

84971

Ku Klux Klan_White Knights Of America

1014877

NIGGERSLAYER

1184100

nigger beaters

58711

niggerzsmellfunny

317512

the "i like to beat negros and mexicans" blog rin

387326

The KKK (Ku Klux Klan)

164821

22. Using Web Mining & Social Network Analysis

493

THE REAL KU KLUX KLAN

1315712

WHITE f**kin PRIDE

240012

White-power

1244436

*

The home page of each group can be found at: http://www.xanga.com/groups/group.aspx?id=[Xanga Group Id]

SUGGESTED READINGS · Burris, V., Smith, E., & Strahm, A. (2000). White Supremacist Networks on the Internet. Sociological Focus 33(2), 215-235. · Chen, H. and Chau, M. (2004). Web Mining: Machine Learning for Web Applications. Annual Review of Information Science and Technology 38, 289-329, 2004. · Freeman, L. C. (2000). Visualizing Social Networks. Journal of Social Structure 1(1). · Kumar, R., Raghavan, P., Rajagopalan, S., & Tomkins, A. (2002). The Web and Social Networks. IEEE Computer 35(11), 32-36. · Lee, E., & Leets, L. (2002). Persuasive Storytelling by Hate Groups Online: Examining Its Effects on Adolescents. American Behavioral Scientist 45, 927-957. · Xu, J. J. & Chen, H. (2004). Fighting Organized Crime: Using ShortestPath Algorithms to Identify Associations in Criminal Networks. Decision Support Systems 38(3), 473-487.

ONLINE RESOURCES · The Hate Directory: http://www.bcpl.net/~rfrankli/hatedir.htm · The Xanga blog hosting site: http://www.xanga.com · The Google blog search engine: http://blogsearch.google.com/

DISCUSSION QUESTIONS 1. Discuss whether and how online hate groups can lead to hate crimes or even terrorist attacks. Suggest some preventive measures. 2. Have you encountered racist or supremacist messages on the Web? What were your reactions towards those messages? Is it possible to ban these messages by law? 3. Discuss how to apply the Web mining and social network analysis techniques presented in this chapter to address other problems in terrorism

494

Chapter 22. Chau & Xu

informatics. 4. New technologies, such as the Web and the blogosphere, have changed the way that supremacists and terrorists recruit new members, spread their ideas, and plan their actions. Discuss how new technologies, besides those discussed in this chapter, can also be used to tackle these issues.

23 AUTOMATIC EXTRACTION OF DECEPTIVE BEHAVIORAL CUES FROM VIDEO Thomas O. Meservy, Matthew L. Jensen, W. John Kruse, Judee K. Burgoon, and Jay F. Nunamaker Jr. Management Information Systems Department, University of Arizona, Tucson, Arizona, U.S.A. ({tmeservy, mjensen, jkruse, jburgoon, jnunamaker}@cmi.arizona.edu)

CHAPTER OVERVIEW This chapter provides an overview of an initial investigation into a novel approach for deriving indicators of deception from video-taped interactions. The team utilized two-dimensional spatial inputs extracted from video to construct a set of discrete and inter-relational features. The features for thirty-eight video interactions were then analyzed using discriminant analysis. Additionally, features were used to build a multivariate regression model. Through this exploratory research, the team established the validity of the approach and identified a number of promising features and future research directions.

495

496

1.

Chapter 23. Meservy, et al.

INTRODUCTION

Deception and its detection have been a source of fascination for centuries, with literally thousands of publications on the topic testifying to its importance in the conduct of human affairs. Deception detection accuracy from manually coded behavioral indicators has typically hovered around 50-50, or chance, even among trained professionals (Levine et al. 2005). Researchers and practitioners have pursued a host of deception detection techniques, from determining trustworthiness from the shape of one’s head and ears, to the use of physiologically-based instruments such as the polygraph and voice stress analyzer, to reliance on behavioral cues as potentially telltale cues to deception. Some of these methods are more reliable than others; however, no single cue has proven to be an accurate indicator of deception. The most promising avenues for distinguishing deceit from truth lie in tools and techniques that utilize constellations of cues. Moreover, because deception indicators are subtle, dynamic, and transitory, they often elude humans’ conscious awareness. If computer-based detection tools can be developed to augment human detection capabilities by discerning features of behavior and by tracking these elusive and fleeting cues over a course of time, accuracy in discerning both truthful and deceptive information and communications should be improved. This chapter outlines initial attempts at identifying and validating a set of behavioral indicators automatically extracted from video.

2.

LITERATURE REVIEW

A primary goal of deception detection research is to identify which behaviors are correlated with deception and to identify behavioral cues that are consistent across contexts. Decades of research have yielded numerous insights into the nature of deception and factors influencing its detection. However, a limited number of consistent cues have been identified. In this section we first discuss the nature of deception and what cues might be exhibited when a person deceives and then we briefly explain some existing methods that have been developed to measure deceptive cues. For ease of comparison, these methods have been classified as physiological methods, verbal methods, and nonverbal methods.

2.1

Evidence of Deception

Deception has been defined in numerous ways (Masip et al. 2004),

23. Automatic Extraction from Video

497

however, for our discussion we adopt Buller and Burgoon’s definition: deception is “the intent to deceive a target by controlling information to alter the target’s beliefs or understanding in a way that the deceiver knows is false” (Buller and Burgoon 1994). Thus, according to this definition, for deception to exist someone must have the intent to mislead another individual. Theories of deception can be roughly dichotomized into nonstrategic and strategic theories of deception. The majority of deception theory focuses on “nonrational, uncontrollable, and low-awareness cognitive processes that trigger nonstrategic cues indicative of deception” (Buller and Burgoon 1994). The process of deceiving can impact an individual’s emotions and/or an individual’s thought processes, which in turn may create outwardly detectable behavior. However, a long stream of research also suggests that individuals strategically and voluntarily adapt behavioral patterns in response to the receiver’s perceived acceptance of previous messages (Buller and Burgoon 1996). By understanding cues that may be triggered in both the nonstrategic and strategic processes of deception, we are better prepared to investigate appropriate methods of deception detection. 2.1.1

Nonstrategic Theory of Deception

The process of deceiving can cause a variety of emotions (Vrij 2000). An individual may feel guilty about telling a lie or may fear being caught. In some cases, individuals feel excitement about being able to fool or trick someone else. These emotions may be manifested in observable, detectable behavior. For example, guilt might result in a decrease of involvement or a shying away from a conversation. Fear might result in heightened arousal, including increased blood flow, heavier breathing, and a rise in vocal pitch. Excitement might be manifested in increased smiling or laughing. In each case, the individual may exhibit outward behavior based on changes in physiological state or emotions felt. If deceivers can appropriately monitor these messages and if they have control over particular communication channels, “they may be able to suppress external manifestations of internal arousal states” (Buller and Burgoon 1994). Deception may also impact the amount and type of thinking involved in an interaction. Creating a plausible lie often requires an individual to manage and weave together multiple streams of information into a coherent story (Zuckerman et al. 1981). Past research suggests that the mental processes for retrieving an actual event are different than fabricating an imagined event (Schacter et al. 1998). Individuals may portray different outward behaviors when a real event is recalled compared to when an imagined one is created. For example, speech dysfluencies, such as ums,

498

Chapter 23. Meservy, et al.

ahs and other pauses may be indicative of increased cognitive load when manufacturing an answer. Additionally, some researchers have noted an increase in the amount of time it takes for an individual to respond to a question (response latency) and also an increase in the blinking of the eyes (DePaulo et al. 2003). 2.1.2

Strategic Theory of Deception

Humans are thoughtful, strategic creatures who closely monitor interpersonal interactions and voluntarily adapt behavioral patterns based on perceived acceptance of previously transmitted messages. During a deceptive interchange, deceivers often take into account the verbal and nonverbal messages of the receiver and adjust their strategies of communication. In addition to the receiver’s behavior, deceivers also monitor their own behavior and adjust their communication strategy. Interpersonal Deception Theory (IDT) (Buller and Burgoon 1996) is the leading theory of deception that views deception as strategic communication. IDT models deception as a strategic interaction between participants. Both the deceiver and the receiver approach an interaction with a number of preconceived factors that will influence the interaction. These factors might include expectations, goals, familiarity, suspicion, and so forth. During the course of the interaction, the deceiver and receiver may alter strategies as their respective effectiveness is observed. During the interaction, both parties will likely unintentionally reveal behavioral signals of their respective deception or suspicion. A variant of this idea is what DePaulo calls a “self-presentational” or “impression-management” perspective on deception. Deceivers deliberately attempt to manage impressions of the interactions in which they are involved. This process of self-regulation consumes additional mental resources (Maruven and Baumeister 2000). When conveying false impressions, deceivers are likely to experience a sense of deliberateness and often act “unnatural” (DePaulo et al. 2003). These actions often come across as planned, rehearsed, or lacking in spontaneity. Table 23-1. Deception theories, sample cues, and deception detection methods Nonstrategic Theories Strategic Theories Arousal and Cognitive Effort Interpersonal Emotions and Memory Deception Theory Deception evokes Deception impacts Deception is a emotions (fear, the amount and dynamic Short delight, etc.) that type of thinking interaction in Description trigger involved in an which the deceiver physiological interaction. and receiver adjust changes or other their actions based

23. Automatic Extraction from Video

Sample Possible Cues / States

Primary Detection Methods

2.2

499

Nonstrategic Theories outward behavior that may be observed Increased heart rate Higher pitch Faster tempo False smiles

Strategic Theories on observed behavior. Response latency Speech disfluencies Fewer details Briefer messages

Physiological Nonverbal

Verbal Nonverbal

Overcontrol Guarded position More word quantity Planned or rehearsed behavior Increasing involvement over time Verbal Nonverbal

Deception Detection Methods

Deception detection methods can be divided into groups based on the types of cues they attempt to capture—physiological methods, verbal methods, and nonverbal methods. Physiological methods capture arousalbased and emotion-based cues. Verbal methods typically capture cognitiveeffort-based, memory-based cues and strategic communication-based cues. Various nonverbal methods attempt to capture cues from all of the discussed categories. Table 23-1 provides an overview of deception perspectives, sample cues, and deception detection methods. 2.2.1

Physiological Methods

Perhaps out of all the approaches to deception detection, the most wellknown is the polygraph or the “lie-detector.” The polygraph relies on cardiac, electrodermal, and pneumo-respiratory measures to infer deception. It is believed that such physiological measures are directly linked to conditions brought on by deception (Vrij 2000). There are two main methods of deception detection that use the polygraph: the Control Question Test (CQT) and the Guilty Knowledge Test (GKT). The CQT uses a series of irrelevant control questions for comparison to crime-specific questions to ferret out possible deception. However, it has often been criticized as subjective, non-scientific, and unreliable (Ben-Shakhar and Elaad 2003). The GKT determines whether an interviewee has knowledge about a crime that would only be known by the perpetrator. A series of crime-related objects or pictures may be shown to the interviewee and the interviewee’s reaction is recorded. The GKT enjoys a more objective, scientific footing

500

Chapter 23. Meservy, et al.

(Ben-Shakhar and Elaad 2003); however, specific and confidential details about a crime must be known for it to be used. Another rising method of deception detection is the analysis of brain activity. Improvements in functional magnetic resonance imaging (fMRI) have allowed the monitoring of brain activity during an interview. Some researchers have noticed differences between the brain activity of truthtellers and deceivers (Ganis et al. 2003; Johnson et al. 2004). Near infrared spectroscopy (NIRS) (Villringer 1993) is an alternative, noninvasive method which uses optical technology to measure neuronal, metabolic, and hemodynamic changes. NIRS shows promise in differentiating truth from lies based on physiological changes in deceivers (Izzetoglu et al. 2003). Most physiological methods of deception detection require the use of invasive sensors attached to the body. Thus, cooperation from the interviewee is required. 2.2.2

Verbal Methods

Two methods of verbal analysis are Criterion-Based Content Analysis (CBCA) and Reality Monitoring (RM). CBCA is based on the UndeutschHypothesis which states that “a statement derived from a memory of an actual experience differs in content and quality from a statement based on invention or fantasy” (Vrij 2000). CBCA takes place during a structured interview where the interviewer scores responses according to predefined criteria such as logical structure, unusual or superfluous details, and selfdeprecation or pardoning the perpetrator. RM also uses a scoring mechanism to judge potential deception, based on the supposition that truthful responses will contain more perceptual, contextual, and affective information than deceptive responses. CBCA and RM require trained interviewers to conduct interviews and trained coders to score the interviews. Although these verbal analysis methods offer more flexibility than the physiological methods, the training required is extensive and results are not immediate. 2.2.3

Nonverbal Methods

Computerized voice stress analysis (CVSA) has been proposed as a method to automatically detect deception. Signals that accompany psychological stress are identified from multiple cues in the voice. Accuracy of CVSA is comparable to the polygraph (Tippett 1994). However, CVSA works best in a controlled environment with little background noise. Observation of behavioral cues is also used as a method of deception

23. Automatic Extraction from Video

501

detection. Numerous studies have shown that deceivers act differently than truth-tellers (Ekman and Friesen 1969; Zuckerman and Driver 1985; DePaulo et al. 2003). Among the differences are lack of head movement (Buller et al. 1994) and lack of illustrating gestures which accompany speech (Vrij et al. 2000). Many people suspect deceivers act differently than truth-tellers; however, most people are mistaken in their beliefs about which cues are associated with deception. Even trained professionals are fooled by over reliance on misleading cues (Vrij 2000). Additionally, the cognitive load of simultaneously tracking behavior and maintaining an interview can be too heavy for a single interviewer to manage.

2.3

Theory for Behavioral Analysis

To avoid the problems associated with the current methods for identifying deceit, we propose a new method of deception detection which builds upon existing nonverbal methods. This method involves automated extraction and identification of behavioral cues which are associated with deception. Interpersonal Deception Theory (Buller and Burgoon 1996) provides the foundation for our method of deception detection. The intention of our method is to automatically identify these indicators of deception. Our method focuses on deriving cues from the head and hands inasmuch as certain movements of the head and hands have been consistently correlated with deception.

3.

RESEARCH METHOD AND EXAMPLES

The research approach that we use to categorize nonverbal behavior into deceptive/truthful classes is commonly used in pattern classification— (1) raw data are split into discrete units, (2) general metrics are extracted from the discrete units, (3) features are extracted and inferred from these metrics, and (4) selected features are used to classify each unit (Duda et al. 2001). The input to this process is nonverbal behavior of an individual captured as video frames and the output is a classification or level of deception or truth.

3.1

Identification of Head and Hands in Video

First, video streams are segmented into discrete, logical units. In an interview setting, these units might typically be responses by the interviewee to a specific question or topic. General metrics are extracted from the video using a method called “blob

502

Chapter 23. Meservy, et al.

analysis.” We utilize a refined method of blob analysis developed by the Computational Biomedicine Imaging and Modeling Center (CBIM) at Rutgers University (Ganis et al. 2003). This method uses color analysis, eigenspace-based shape segmentation and Kalman filters to track head and hand positions throughout the video segment. Lu et al (Lu et al. 2005) explain this process in detail. While we choose to use blob analysis to track the head and the hands, other tracking methods could also be employed. Metrics—including position, size, and angles—are produced by the software and are utilized when generating additional meaningful features. Figure 23-1 shows a video frame that has been subjected to blob analysis.

Figure 23-1. Video frame after blob analysis

3.2

Feature Extraction

A number of features can be extracted or inferred from the relatively simple metrics produced in the previous phase. Many of these features attempt to capture some of the key elements that researchers would look for when trying to detect deception (e.g. behavioral over control). However, a number of additional features that typically aren’t used by humans (e.g., distance of movement per frame) are extracted because of their potential discriminatory power in an automated environment.

23. Automatic Extraction from Video

503

Figure 23-2. Taxonomy for kinesics-based deceptive features in video data

The movement-based or kinesics-based deceptive features that are extracted from video can be sub-divided into single frame features and multiple frame features. Single frame features, as the name implies, are calculated using information from a single video frame. These features can be further categorized as descriptive, relational, or multi-relational features. Multiple frame features require information from two or more frames. Multiple frame features can be classified as descriptive, angular movement, or directional features. Figure 23-2 illustrates a taxonomy of these kinesicsbased features.

3.3

Single Frame Features

The features in the descriptive category of single frame features are actually provided as the output of blob analysis. These features include the center position of each blob (x, y), the height (h) and width (w) of each blob, and the angle of the major axis (q). Figure 23-3 illustrates these features as they relate to a single blob.

504

Chapter 23. Meservy, et al.

Figure 23-3. Single frame descriptive features

Figure 23-4. Blob distance features

The relational category of single frame features contains features that represent relationships between two objects—either a blob to another blob or a blob to a reference point or area. In the former case, the distance between two blobs of interest is calculated using a simple Euclidean distance formula. Figure 23-4 demonstrates some single frame relational features; specifically distance features. The distance between the head, the right hand, and the left hand allows us to know when they are touching (distance is zero) or how far apart they are. This may hint at gestures that are indicative of nervousness (such as preening, scratching, rubbing, etc), but only between the objects identified. Features that track a blob in comparison to other regions are also part of the relational category. Quadrants derived from the head position and head

23. Automatic Extraction from Video

505

width have been used in other experiments (Burgoon et al. 2005). We extract quadrant information in a similar manner, creating one region for the area above the shoulders (quadrant 1) and three areas below (quadrants 2-4). Quadrant 3 is derived based on the width of the head. Quadrants 2 and 4 occupy any additional area to the left and right, respectively. Figure 23-5 maps the quadrants onto the sample video frame. This feature allows us to understand how often each blob is in each quadrant. It was hypothesized that the hands of deceivers, who are more closed in their posture, would spend more time in quadrant 3 than truth tellers (Burgoon et al. 2005).

Figure 23-5. Quadrant features

The multi-relational category contains features that involve information from 3 or more blobs or objects. The features of interest in our approach include calculating the area of the triangle between the 3 blobs, the distance from each blob to the center point of the triangle, and the angle of each blob in relation to the center of the triangle. The area of the triangle is calculated using the center points from the head and hands in Equation 23-1.

((x

head

* yleft - xleft * yhead ) + (xright * yhead - xhead * yright) + (xleft * yright - xright * yleft )) 2 Equation 23- 1

506

Chapter 23. Meservy, et al.

Figure 23-6. Triangle Area Feature

Figure 23-6 depicts the triangle area feature. This feature can show the openness of the individual’s posture. Additionally, we get a feel for when the hands touch the head or each other (the triangle area is zero). However, we have to rely on other features to determine which blobs are involved. The distance from each blob to the center of triangle uses a simple Euclidean distance formula. The formula uses the center point coordinates from one of the blobs and the center point of the triangle. Figure 23-7 illustrates this feature. This feature captures the relationship of one blob to the two other blobs in a single metric and may provide insight into posture of an individual. A blob’s angle relative to the center of the triangle is also classified into the multi-relational category of single frame features. The center point of a blob and the triangle center are used when calculating the angle. This angle, initially in radians, is converted to degrees. Figure 23-8 illustrates the triangle center angle feature for a right hand blob. This feature can discriminate when one hand is up but not the other or when the body is asymmetric (both hands to the left or right of the head).

23. Automatic Extraction from Video

Figure 23-7. Distance to triangle center

Figure 23-8. Tri. center angle features

507

508

3.4

Chapter 23. Meservy, et al.

Multiple Frame Features

The features in the descriptive category of multiple frame features are calculated using the descriptive single frame features. The distance feature tracks how much a single blob has moved from one frame to another. Figure 23-9 illustrates this concept for a right-hand blob between frame one (dashed border) and frame two (solid border). Once again this distance is calculated using a simple Euclidean distance formula. Since we calculate this metric for each frame, which represents approximately 1/30th of a second, we can also view this metric as a representation of speed of movement. This gives us insight into how much an individual moves her or his head and hands over time.

Figure 23-9. Multiple frame distance feature

Another feature in the multiple frame descriptive category is angle difference. To calculate this feature we simply subtract the last frame’s angle for a specific blob from the current frame’s angle for that same blob. Whether this feature is positive or negative captures not only the rotation of the major axis, but also the direction of rotation. It was hypothesized that the angle differences for the head may be useful, but not for the hands. By naïve observation it was noticed that the shape of the hand blobs and the major axis frequently change when the hands are pivoted at the wrist. The angular movement category of multiple frame features contains features that attempt to capture arced movement of a blob over a period of time.

23. Automatic Extraction from Video

509

(q 1 + q 2 + ... + q n ) n

Figure 23-10. Angular movement feature

Figure 23-10 illustrates how this is calculated for a series of frames. The first frame serves as a reference point and vectors are calculated using the first frame as the origination point and other frames as destination points. Polar coordinate angles are calculated for each vector. The angular movement feature consists of the average change in vector angles. Our calculations utilize 5 frames when calculating this feature. This feature was designed to capture patterns that are representative of certain types of illustrator gestures. The multiple frame directional category of features contains information about the direction that a blob has moved. A vector is created using the center points of the same blob in two different frames and a polar coordinate angle is extracted and converted to degrees. This feature can further be split into binary-value classifications (e.g. up, up-left, down-left, right, etc). It is hypothesized that these values will be particularly useful when using timeseries analysis and it is anticipated that they will capture information associated with illustrator and adaptor gestures.

3.5

Analysis of Summarized Features

In order for these extracted features to be analyzed by specific statistical methods, such as discriminant analysis and multiple regression, they need to be summarized over the length of a segmented video clip. Simple descriptive statistics (means and variances) are calculated for all of the features for each video segment. We anticipated that the variance of some features would be more telling than the feature itself. For example, by calculating the variance of the triangle area, we can quickly see how much

510

Chapter 23. Meservy, et al.

overall change in hand and head position occurred during the length of the clip.

4.

EXPERIMENTS AND RESULTS

The features described above were used to identify deception in a Mock Theft experiment.

4.1

Description of Mock Theft Experiment

The purpose of the Mock Theft experiment (Burgoon et al. 2003; Burgoon et al. 2003) was to reveal cues that can be used in deception detection. In this experiment, a wallet was left unattended in a classroom and some participants played the role of a thief who took the wallet. Other participants either observed the theft or were unaware of the theft. All the participants were interviewed by untrained and trained interviewers via chat, audio-only, and face-to-face channels and these interactions where recorded. The participants in the experiment were undergraduate students in a large mid-western university. The face-to-face interactions from the Mock Theft experiment where used in this study. There were a total of 42 possible face-to-face interactions that could be included in the study. Four were not used because of problematic video capture or because the participant did not follow instructions. Each interaction was composed of a number of questionanswer exchanges. In this study only the theft narrative was included in the analysis. Of the 38 responses, 16 were truthful and 22 were deceptive.

4.2

Discriminant Analysis

Initially, we used discriminant analysis to evaluate the features that were extracted from the video segments. Due to the exploratory nature of this research, we decided to do a stepwise discriminant analysis. Initially, with stringent entrance and exit criteria few features were selected and classification results were little better than chance. However, using less stringent exit and entrance criteria (p-in .20 and p-out .30) a larger number of variables were included in the model, the model was even more significant, and classification accuracy increased substantially. While many of the features included in the final model are directly supported by current deception theory, some of the features need to be examined in more detail to understand why they discriminate truth from deception. Table 23-2 displays the features included in the final discriminant analysis model.

23. Automatic Extraction from Video

511

Table 23-2. Features included in discriminant analysis model Category Feature Single frame descriptive Average head x Average triangle center x Variance of the right hand height Variance of the right hand angle Single frame relational features Average time the right hand was in quadrant 2 Average time the right hand was in quadrant 4 Single frame multi-relational Average of the left hand triangle center angle Variance of the left hand triangle center angle Multiple frame descriptive Average right hand angle difference Variance of the head angle difference Angular movement features Average head angular movement sum Average of the left hand angular movement sum Variance of the left hand angular movement sum Variance of the head angular movement sum

The results of the discriminant analysis are shown in Table 23-3. The deceptive and truthful participants were classified with an accuracy rate of 95.2% percent. However, when using hold-one out cross validation, the accuracy falls to 88.1% percent. This preliminary result appears promising in its discriminatory ability as the overall model is highly significant (p< .001). Table 23-3. Discriminant analysis accuracy results Predicted Actual Truthful Original Truthful 94.7 Deceptive 4.3

4.3

Deceptive 5.3 95.7

Regression Model

As part of the mock theft experiment, participants were asked to rate the level of honesty (a number from 1 to 10) that they displayed during the narrative portion of the experiment. We built a multivariate regression model with honesty level as the dependent variable. We used the same starting features as we did in the discriminant analysis and then used forward stepwise regression (p-in .10; p-out .20) to create a

512

Chapter 23. Meservy, et al.

predictive model of honesty. The resulting model had an R2 of .775, an adjusted R2 of .600. Predictors for this model are displayed in Table 23-4. Table 23-4. Discriminant analysis accuracy results Category Feature Single frame descriptive Average triangle x Variance of the right hand angle Single frame multi-relational Average angle of the head to triangle center Variance of the distance between the left hand and the triangle center Average distance between the head and the triangle center Multiple frame descriptive Average of the squared distance the head moved between frames Variance of the change in right hand angle between frames

As a whole, the model had a significance of p=.0000355. The ANOVA table for the overall model is shown in Table 23-5. Table 23-5. Regression ANOVA Sum of Df Squares Regression 417.366 7 Residual 278.146 33 Total 695.512 40

Mean Square

F

Significance

59.624 8.429

7.074

.0000355

While the regression model shows promise for the task of classifying the level of honesty of an individual under similar circumstances, the main purpose of applying the statistical methods was to help understand the contributions of the extracted features and validate our hypothesis about their usefulness. Additional testing and refinement of the models need to occur to validate the predictive ability. However, we believe the utility of these novel features and the method of deception detection described in this chapter is supported by this and other preliminary studies (Jensen et al. 2005; Meservy et al. 2005; Meservy et al. 2006).

5.

CONCLUSION

The automated extraction of behavioral cues associated with deception exceeds typical human performance and overcomes many of the weaknesses that hinder other methods of deception detection. It is noninvasive and can

23. Automatic Extraction from Video

513

be used without cooperation from the interviewee. This method allows flexibility, could provide prompt feedback, and does not require specially trained interviewers. This method does not require the same controlled setting as many of the other deception detection methods mandate and capitalizes on numerous nonverbal indicators of deception identified throughout the deception literature.

6.

ACKNOWLEDGEMENTS

Portions of this research were supported by funding from the U. S. Air Force Office of Scientific Research under the U. S. Department of Defense University Research Initiative (Grant #F49620-01-1-0394) and Department of Homeland Security - Science and Technology Directorate under cooperative agreement NBCG20300030001. The views, opinions, and/or findings in this report are those of the authors and should not be construed as an official U.S. Government position, policy, or decision. A previous version of this chapter was presented at the 2005 IEEE International Conference on Intelligence and Security Informatics held in Atlanta, Georgia and is published in its proceedings.

REFERENCES Ben-Shakhar, G. and E. Elaad (2003). "The Validity of Psychophysiological Detection of Information with the Guilty Knowledge Test: A Meta-Analytic Review." Journal of Applied Psychology 88(1): 131-151. Buller, D., J. Burgoon, et al. (1994). "Interpersonal Deception: VII. Behavioral Profiles of Falsification, Equivocation and Concealment." Journal of Language and Social Psychology 13(4): 366-395. Buller, D. B. and J. K. Burgoon (1994). Deception: Strategic and nonstrategic communication. Strategic interpersonal communication. J. A. Daly and J. M. Wiemann. Hillsdale, NJ, Erlbaum: 191-223. Buller, D. B. and J. K. Burgoon (1996). "Interpersonal Deception Theory." Communication Theory 6: 203-242. Burgoon, J. K., M. Adkins, et al. (2005). An Approach for Intent Identification by Building on Deception Detection. Hawaii International Conference on System Science (HICSS'05), Hawaii. Burgoon, J. K., J. P. Blair, et al. (2003). Effects of Communication Modality on Arousal, Cognitive Complexity, Behavioral Control and Deception Detection During Deceptive Episodes. Annual Meeting of the National Communication Association, Miami Beach, Florida. Burgoon, J. K., J. P. Blair, et al. (2003). Detecting Deception through Linguistic Analysis. NSF/NIJ Symposium on Intelligence and Security Informatics. DePaulo, B., J. Lindsay, et al. (2003). "Cues To Deception." Psychological Bulletin 129(1): 74-118.

514

Chapter 23. Meservy, et al.

Duda, R. O., P. E. Hart, et al. (2001). Pattern Classification. New York, Wiley. Ekman, P. and W. V. Friesen (1969). "Nonverbal Leakage and Clues to Deception." Psychiatry 32: 88-105. Ganis, G., S. M. Kosslyn, et al. (2003). "Neural Correlates of Different Types of Deception: An fMRI Investigation." Cerebral Cortex 13(8): 830-836. Izzetoglu, K., G. Yurtsever, et al. (2003). NIR spectroscopy measurements of cognitive load elicited by GKT and target categorization. Jensen, M. L., T. O. Meservy, et al. (2005). Identification of Deceptive Behavioral Cues Extracted from Video. International IEEE Conference on Intelligent Transportation Systems, Vienna, Austria. Johnson, R., J. Barnhardt, et al. (2004). "The contribution of executive processes to deceptive responding." Neuropsychologia 42: 878-901. Levine, T. R., T. H. Feeley, et al. (2005). "Testing the Effects of Nonverbal Behavior Training on Accuracy in Deception Detection with the Inclusion of a Bogus Training Control Group." Western Journal of Communication 69(3): 203-217. Lu, S., G. Tsechpenakis, et al. (2005). Blob Analysis of the Head and Hands: A Method for Deception Detection. Hawaii International Conference on System Science (HICSS'05), Hawaii. Maruven, M. and R. F. Baumeister (2000). "Self-Regulation and Depletion of Limited Resources: Does Self-Control Resemble a Muscle." Psyhcological Bulletin 126(2): 247. Masip, J., E. Garrido, et al. (2004). "Defining deception." Anales de Psicología 20(1): 147171. Meservy, T., M. L. Jensen, et al. (2005). "Deception Detection through Automatic, Unobtrusive Analysis of Nonverbal Behavior." IEEE Intelligent Systems (September/October). Meservy, T. O., M. L. Jensen, et al. (2006). Detecting Deception in a Security Screening Scenario. Thirty-Ninth Annual Hawaii International Conference on System Sciences (CD/ROM), Kauai, Hawaii, IEEE Computer Society Press. Schacter, D. L., K. A. Norman, et al. (1998). "The cognitive neuroscience of constructive memory." Annual Review of Psychology 49(30): 289. Tippett, R. G. (1994). "A Comparison Between Decision Accuracy Rates Obtained Using the Polygraph Instrument and the Computer Voice Stress Analyzer in the Absence of Jeopardy." Retrieved September, 2003, from: http://campus.umr.edu/police/cvsa/compar1.htm. Villringer, A. (1993). "Near infrared spectroscopy (NIRS): a new tool to study hemodynamic changes during activation of brain function in human adults." Neuroscience Letters 154: 101. Vrij, A. (2000). Detecting Lies and Deceit: The Psychology of Lying and the Implications for Professional Practice. West Sussex, John Wily & Sons Ltd. Vrij, A., K. Edward, et al. (2000). "Detecting Deceit via Analysis of Verbal and Nonverbal Behavior." Journal of Nonverbal Behavior 24(4): 239 - 263. Zuckerman, M., B. M. DePaulo, et al. (1981). Verbal and nonverbal communication of deception. Advances in Experimental Social Psychology. L. Berkowitz. New York, Academic: 1-59. Zuckerman, M. and R. E. Driver (1985). Telling Lies: Verbal and Nonverbal Correlates of Deception. Nonverbal Communication: An Integrated Perspective. A. W. Siegman and S. Feldstein. Hillsdale, NJ, Erlbaum: 129-147.

23. Automatic Extraction from Video

515

SUGGESTED READINGS Deception · Buller, D. B. and J. K. Burgoon (1996). "Interpersonal Deception Theory." Communication Theory 6: 203-242. An explanation of Interpersonal Deception Theory that views deception as a strategic interaction between deceiver and receiver. During the course of the interaction, the deceiver and receiver may alter strategies as their effectiveness is observed. · Vrij, A. (2000). Detecting Lies and Deceit: The Psychology of Lying and the Implications for Professional Practice. West Sussex, John Wily & Sons Ltd. An excellent review of the practical aspects of deception detection methods in real-world environments · DePaulo, B., J. Lindsay, et al. (2003). "Cues To Deception." Psychological Bulletin 129(1): 74-118. A comprehensive meta-analysis of deceptive research and indicators of deception. Blob Analysis used for Deception Detection · Lu, S., G. Tsechpenakis, et al. (2005). Blob Analysis of the Head and Hands: A Method for Deception Detection. Hawaii International Conference on System Science (HICSS'05), Hawaii. An in-depth, mathematical explanation of blob analysis. · Meservy, T., M. L. Jensen, et al. (2005). “Deception Detection through Automatic, Unobtrusive Analysis of Nonverbal Behavior.” IEEE Intelligent Systems (September/October). An overview of our approach of deception detection and a comparison of various classification methods including discriminant analysis, alternating decision trees, neural networks, and support-vector machines.

ONLINE RESOURCES · Center for the Management of Information (CMI) http://www.cmi.arizona.edu A research center at the University of Arizona that conducts numerous innovative experimental, field, and systems research programs including the Automatic Detection of Deception and Intent. CMI and its partners have developed a number of deception corpuses for various environments and contexts. · Center for BioImaging and Modeling (CBIM) http://cbim.rutgers.edu/ A research center at Rutgers University conducts novel research in the

516

Chapter 23. Meservy, et al.

areas of Computational BioMedicine, Computer Vision and Computer Graphics. CBIM developed the head and hand tracking software we use in our method of deception detection. · Open Source Computer Vision Library (OpenCV) http://www.intel.com/technology/computing/opencv/index.htm An extensive and well-accepted computer vision library that includes modules for gesture recognition and motion tracking. · Department of Defense Polygraph Institute http://www.dodpi.army.mil/ US Department of defense institute that does polygraph research and trains federal polygraphers.

DISCUSSION QUESTIONS 1. How common is deception? In your daily life? In different cultures? 2. When deception occurs, how often are behavioral indicators of deception emitted? Are they the same in different contexts? What factors would affect the emmision of deceptive indicators? 3. What are the benefits and drawbacks of using a constellation of cues to detect deception? 4. Which indicators of deception (listed in this chapter and the other references) can be automatically extracted? Which computational methods are most appropriate for each indicator of deception? Why? 5. How would you categorize behavioral methods of deception detection? (Invasiveness, cost, accuracy, and operational expertise needed, etc.) 6. What are the benefits and limitations of the proposed method in comparison to other existing methods of deception detection? In what situations would this method be most applicable?

24 SITUATIONAL AWARENESS TECHNOLOGIES FOR DISASTER RESPONSE Naveen Ashish1, Ronald Eguchi2, Rajesh Hegde3, Charles Huyck2, Dmitri Kalashnikov1, Sharad Mehrotra1, Padhraic Smyth1, and Nalini Venkatasubramanian1 1

Donald Bren School of Information and Computer Sciences, University of California, Irvine, California, U.S.A. ({ashish, dvk, sharad, smyth, nalini} @ics.uci.edu); 2Image Cat, Inc., Long Beach, California, U.S.A. ([email protected]); 3Department of Electrical and Computer Engineering, University of California, San Diego, California, U.S.A. ([email protected])

CHAPTER OVERVIEW This chapter highlights some of the key information technology challenges being addressed in the RESCUE project, a National Science Foundation (NSF) funded 5-year effort, with a particular focus on situational awareness technologies. A key premise of the project is that the critical decision making required in disaster situations relies heavily on the availability, accuracy, and timeliness of information that can be made available to the decision makers. A major thrust within RESCUE is focusing on developing next generation situational awareness technologies. Our approach in building situational awareness systems is to build information systems that consider situations and events as fundamental entities, and our research is focused on the key technical challenges in the extraction and synthesis, management, and analysis of such situational information. This chapter focuses on our research accomplishments in each of these areas and also provides an overview of technology transition activities.

517

Chapter 24. Ashish, et al.

518

1.

INTRODUCTION

Responding to natural or man-made disasters, in a timely and effective manner, can reduce deaths and injuries, contain or prevent secondary disasters, and reduce the resulting economic losses and social disruption. During a crisis, responding organizations confront grave uncertainties in making critical decisions. They need to gather situational information (e.g., state of the civil, transportation and information infrastructures), together with information about available resources (e.g., medical facilities, rescue and law enforcement units). There is a strong correlation between the accuracy, timeliness, and reliability of the information available to the decision-makers, and the quality of their decisions. Dramatic improvements in the speed and accuracy at which information about the crisis flows through the disaster response networks has the potential to revolutionize crisis response, saving human lives and property. This chapter highlights some of the key information technology challenges being addressed in the Project RESCUE1 [1], with a particular focus on situational awareness technologies. Appreciating the IT challenges in improving crisis response requires a thorough understanding of how communication and control networks form among responding organizations, and how the response process is organized. Since the crisis domain might be new to a large number of readers, we begin by first briefly summarizing the crisis response process. This is done to set the stage for a discussion of the challenges being addressed by RESCUE and particularly the situational awareness thrust within it.

1.1

The Crisis Response Process

Organized crisis response activities include measures undertaken to protect life and property immediately before (for disasters where there is at least some warning period), during, and immediately after disaster impact. Such activities may span a few hours to days or even months, depending upon the magnitude of the event. Depending upon the scale of the disaster, crisis response may be a large-scale, multi-organizational operation involving many layers of government, public authorities (such as state1

The work reported in this paper is part of the RESCUE Project (http://www.itr-rescue.org) whose goal is to radically transform the ability of organizations to gather, manage, analyze and disseminate information when responding to man-made and natural catastrophes. The ‘Responding to Crises and Unexpected Events’ (RESCUE) Project is funded in part by National Science Foundation (NSF) through its large ITR program under contract numbers 0331707 and 0331690.

24. Situational Awareness Technologies for Disaster Response

519

managed utility companies), commercial entities, volunteer organizations, media organizations, and the public. In a crisis, these entities work together as a virtual organization to save lives, preserve infrastructure and community resources, and reestablish normalcy within the community. Depending upon the magnitude of the crisis, the operation of this virtual organization can span multiple levels. Field level operations such as evacuation, traffic management, triage, and provision of medical services are usually under the control of an on-site incident commander that reports back to a central Emergency Operations Center (EOC). In a large disaster, the management of area-wide resources requires a broader participation of government and industry. In large urban areas such as Los Angeles and New York, it is not uncommon for each city within a county to have its own EOC where representatives from fire, police, utility companies, Red Cross, and many other organizations participate in the response. Furthermore, each agency represented in the City EOC also has its own emergency operations center, usually in another location. In addition to these government-run centers, private industry (large businesses, NGO’s, etc.) may also set up response centers that feed and receive information from government EOCs. While small disasters may be handled at the local level, the resources of local governments can become overwhelmed by the demands of larger events; in these cases, higher levels of the government become active participants in the response effort. Such a large-scale response may involve hundreds of autonomous organizations with different tasks and priorities. For example, a county-wide disaster in the Los Angeles Area may mobilize emergency offices of State, County, and up to 88 different municipal authorities, along with a variety of other organizations (including fire departments, health services agencies, and NGOs such as the Red Cross), Each of these organizations may themselves represent a large consortium; for example, the health services organizations may consist of a variety of hospitals, triaging services, clinics, etc. The Response Cycle: Irrespective of the nature and scale of the crisis and the organizations involved, crisis response activities can be viewed (at an abstract level) as consisting of four interrelated phases: · Damage assessment: In this phase, disaster-related losses are identified on both incident-level and regional scales, and their magnitudes are assessed. Severely impacted areas, disruptions to critical infrastructure, situations where secondary hazards may develop if initial damage is not mitigated (e.g., earthquake-induced hazardous materials releases or dam failures), and other problems of high urgency are identified, and estimates of the time needed to restore disrupted systems are developed. · Needs assessment: In this phase, incidents requiring some level of response are identified. For example, building collapses where victims

Chapter 24. Ashish, et al.

520

are trapped may require search, rescue and medical resources, release of hazardous materials may require large-scale evacuation, etc. Operationally, these incidents are assigned a measure of urgency/priority, typically based on immediate threats to life safety. · Prioritization of Response Measures: In this phase, incidents requiring response are matched with available resources. If the total demand is greater than the system’s capacity to respond – as is invariably the case in large-scale disasters – decision-makers must establish priorities for response. Decision-makers must have an accurate assessment of the disaster situation and available resources in order to establish priorities. · Organizational Response: In this phase, emergency resources are deployed and organizational decisions are disseminated to crisis-workers and the population at large. Ideally, response activities take place in accordance with pre-disaster planning. Decision-support systems are used to track key incidents and the progress of responding units, to optimize response activities, and to act as a mechanism for queuing ongoing incidents. Each aspect of the above process is part of an ongoing cycle, in which assessments, decisions, and interventions at one point in time produce implications for subsequent response activities. As the response proceeds and as more accurate information becomes available, new problems are identified, decisions are reassessed, and response activities may be reprioritized and sometimes even reversed. For this process to proceed effectively, government leaders, response personnel, and other actors must communicate rapidly with one another during each phase. The quality of the resulting decisions and the speed with which the process transitions through the four phases depends upon the timeliness and accuracy of information available to response workers.

1.2

IT Challenges and RESCUE

In the RESCUE Project, our focus is to radically transform the speed and accuracy with which information flows through disaster response networks, networks that connect multitudes of response organizations as well as the general public. We are working to develop information technology solutions that dynamically capture and store crisis-relevant data as it is generated, analyze this data in real-time, interpret it, and disseminate the resulting information to decision makers in the forms most appropriate for their various tasks. Challenges in realizing such IT solutions arise due to the scale and complexity of the problem domain, the diversity of data and data sources, the state of the communication and information infrastructures through which the information flows, and the diversity and dynamic nature

24. Situational Awareness Technologies for Disaster Response

521

of the responding organizations. Internet

T-3 Circuit

Red Cross

County EOC

Internal Services

Chief Admin Office

Public Works

Health Services

Internet

Sheriff (2) Fire

STATE

LA City

22 Sheriff Stations

Social Services Coroner

87 Cities by Internet Figure 24-1. LA County Disaster Network

Diversity of Information Sources: Information relevant to decision making may be dispersed across a hierarchy of storage, communication, and processing units – from sensors (in-situ sensors, satellite imagery, remote sensing) where data is generated to heterogeneous databases belonging to autonomous organizations. Critical information may span various modalities – e.g., field-observations communicated via voice conversations among emergency workers, video data transmitted from cameras embedded in civil infrastructures, dispersed at crisis site, or carried by first responders, sensor data streams, or textual and relational information in databases. In some cases, information may even be embedded in the relationships among persons themselves; for instance, the migration and patterns of those fleeing an incident site may provide valuable clues as to the nature and exact location of the incident. Diversity of Information Users: Information may need to be shared across diverse, loosely coupled, emergent multi-organizational networks in which different entities play different roles in response activities, have different needs and urgencies, have different cultures, and may have vastly different capabilities with respect to technology utilization. These organizations may or may not have policies in place regarding data sharing and collaboration. Furthermore, these organizational networks must rapidly reconfigure to adapt to the changing communication and control demands present during crisis events. Finally, different people/organizations have different needs and urgency levels regarding the same information. For example, while a field worker might require detailed information about the

522

Chapter 24. Ashish, et al.

specific location of hazardous materials in a burning building, the monitoring and response team at a nearby command center may only need to know the number of hazardous-material locations in the vicinity of the catastrophe. State of the Infrastructure: Information must be transferred across highly distributed, mobile infrastructure consisting of heterogeneous communication channels and systems that are prone to failures and vulnerable to attacks during a crisis. To address the above challenges in building an information infrastructure that provides reliable, timely, and integrated information, we are developing technology at two levels. At the systems level our goal is to develop robust communications and systems infrastructure to ensure connectivity and availability of reliable and efficient pipeline for information flow between different organizations and entities. For instance the Robust Networking project within RESCUE is focused on developing systems that provide computing, bi-directional communication, and higher layer services at a crisis site. The crisis site may lack electric power, fixed communication networks may be unpredictable, and responders might bring in heterogeneous mutually conflicting communication technologies. The goal is to develop a system that can operate under such extreme conditions by consolidating and enhancing available systems and seamlessly extending new capabilities to all end users and devices as communication services get incrementally restored. The Information Dissemination project (part of RESCUE) is exploring how customized warnings, alerts, advisories, and messages can be disseminated to the public at large under extreme situations when the infrastructure is failing and under surge demands. The approach developed exploits peerbased techniques to achieve fast, reliable, and scalable dissemination. At the informatics level, the RESCUE project is exploring capabilities for information collection, sharing, fusion, and analysis. For instance, in the situational awareness project our objective is to design and develop technologies that can create actionable situational awareness from the avalanche of heterogeneous multi-modal data streams (audio, speech, text, video, etc.) including human-generated input (e.g., first responders’ communications, field reports, etc.) during or after a disaster. In the Information sharing project we are developing a flexible, customizable, dynamic, robust, scalable, policy-driven architecture that ensures seamless information sharing amongst all entities involved in response with minimal manual human intervention and automated enforcement of informationsharing policies. Finally, privacy concerns in infusing technology into real-world processes and activities arise for a variety of reasons, including unexpected usage and/or misuse for purposes for which the technology was not

24. Situational Awareness Technologies for Disaster Response

523

originally intended. These concerns are further exacerbated by the natural ability of modern information technology to record and make persistent information about entities (individuals, organizations, groups) and their interactions with technologies – information that can be exploited in the future against the interests of those entities. Such concerns, if unaddressed, constitute barriers to technology adoption or worse, result in adopted technology being misused to the detriment of the society. Another of our objectives thus is to understand privacy concerns in adopting technology from the social and cultural perspective, and design socio-technological solutions to alleviate such concerns. The challenge guiding our research is whether Information Technologies can be designed with “knobs” that can be used to control disclosure of information amongst entities (individuals, organizations, government) with the objective of empowering technology adopters to fit the technology into existing (and possibly dynamically evolving) societal and cultural expectations with respect to privacy. In this section we have introduced the RESCUE project and provided a brief overview of the various research thrusts centered on the IT challenges in improving disaster response. The following sections will focus on the situational awareness project, including our objectives, approach, research in various areas and also technology transition into artifacts.

2.

SITUATIONAL AWARENESS

2.1

Response and Situational Awareness

Each of the different sub-phases of response, as described in the introduction, as well as phases of a disaster cycle are decision-centric in which individuals and organizations make critical decisions that have implications on life and property. The quality of such decisions depends upon a variety of factors including social and cultural factors, level of expertise knowledge, and training, the established practice, etc. Among the most critical factors (of central interest to us in the situational awareness project) is the awareness of the situation (past, present, and future) and implications of actions or inactions. The situational information broadly consists of information about people (their vulnerabilities, location, demographics), resources (food, water, shelter) and progression of the event and activities (plume spread, storm track, evacuation progress). Our objective in the situational awareness project is to significantly enhance the situational awareness of decision-makers thereby improving their ability to make correct decisions. Specifically our goal is to develop advanced information processing and management technologies to turn the available

524

Chapter 24. Ashish, et al.

information into actionable information for people and decision systems.

2.2

A Situational Awareness Driven Application

As a motivating example, we present a real world application and process that we believe could benefit significantly (in terms of efficacy and timeliness) from advanced situational awareness technologies. Damage assessment is an important task, immediately following a major disaster such as a hurricane or earthquake. An accurate and timely estimate of damage in the impacted and surrounding areas can help in several important decisions, such as resource allocation in response. The information, using which such assessments can be made, is collected in a variety of different ways: through use of aerial or satellite imagery; ground or field coverage; simulating the effects of the disaster through sophisticated loss or impact modeling tools – these tools are common for most hazards (e.g., hurricane, flooding, and earthquake); and finally use of information that becomes available on the internet – this may include blogs, internet surveys (e.g., the “did you feel it” system operated by the U.S. Geological Survey for earthquake events), reports by government or non-profit organizations. The typical modalities for post-disaster information can include the following: aerial photos, field-based photos, satellite imagery (low, moderate and high-resolution optical data; radar or synthetic aperture radar data; lidar), video (with possibly audio commentaries), written reports, simulation results, etc. Data sources for much of this information come from government agencies (NOAA, USGS, FEMA, NASA, and local and state emergency response organizations); non-profit organizations, such as the Red Cross; industry (companies affiliated with or providing data to the insurance industry), and the public (e.g., through the internet) All the above, raw, information today needs to be collected from the different sources above and then processed and integrated, mostly manually. Ultimately this information must be analyzed to convey the following kinds of information: a) areas of greatest impact, measured in terms on expected losses, lives lost, and social disruption; b) areas needing immediately response, either because of developing incidents, e.g., fire-following earthquake, or flooding after a storm; and c) areas that may be impacted by impeding disasters, e.g., level breaks because of excessive storm surge. The above problem is precisely of the nature that our situational awareness technologies aim to address i.e., if we can employ such technologies to make the information processing pipeline from raw disparate information to the end damage assessment analyses above, more automated, efficient, and timely. We now describe the technologies we are developing that can make such an assessment analysis application feasible.

24. Situational Awareness Technologies for Disaster Response

2.3

525

Our Approach

Our approach to building situational awareness systems is an eventcentric one i.e., one that is centered around events as fundamental units of information. The motivation comes from our observation that situations (including disaster situations) are fundamentally comprised of events at various levels. For instance the out break of a fire, recovery of victims, dispatch of responders, collapse of a bridge are all events in a situation. It is information about such events that feeds into the analysis tools of the kinds described above. In very general terms an event is an occurrence of something of interest of a certain type, at a certain place and at/over a certain period of time. It is a semantic, domain independent concept which may have associated with it a set of different entities that play different roles and that may bear relationships to other events and/or to other entities in the real world. Events, in our view, provide a natural abstraction for modeling, representing, and reasoning about situations. We have identified the following three key technical components in building situational awareness systems centered around events. 1. Event Extraction, Interpretation, & Synthesis - Multi-modal extraction, fusion and assimilation technology that enables the extraction and synthesis of higher level situational information from low level (signal) inputs. For instance in the damage assessment application above, we need automated capabilities to process the various pieces of information, such as images, audio and video feeds, text feeds, etc. and also integrated and fuse information coming from multiple disparate sources. Visualization, analysis, mining

Event analysis and visualization Event oriented querying

Event data management Structured, synthesized information

Event extraction, interpretation, and synthesis Raw multi-modal input

Figure 24-2. Situational Awareness System Tiers

2. Event Data Management – Technologies that support modeling, storing, querying and indexing, situational information. In the damage

526

Chapter 24. Ashish, et al.

assessment application for example, we need data management capabilities for storage and structured querying of the information collected, processed and integrated in the ingest phase. The information obtained about the unfolding situation and status should be queryable in a structured manner.

Figure 24-3. Situational Awareness System: Architecture

3. Event Analysis and Visualization – An environment that supports end user analysis and visualization tools over the situational information. The end goal is to obtain information useful for decision making, for instance assessments of damage, predicted areas still in danger, estimates of

24. Situational Awareness Technologies for Disaster Response

527

evacuation times etc. This aspect of situational awareness technologies is concerned with such analysis tools (model based simulations, estimation tools etc as an example) that perform such analysis over the collected information now in a situational database. Event information thus flows through the three tiers described above. Events are first extracted from raw information, then stored and indexed in an event database, and finally end user analysis and visualization capabilities are provided over these extracted and stored events. An important point we wish to emphasize is that events in our view are independent of the media that they may be captured in and extracted from. The event is a higher level semantic concept corresponding to a real-world occurrence and abstracted from the media it is captured in. We now describe our work and progress related to the three tiers.

3.

EVENT EXTRACTION

Event extraction is concerned with the extraction of high level events from raw streams, we are interested in event extraction from streams of all modalities i.e., text, audio, and video. Recall that we mentioned that human generated information is a key and often major source of information during disasters. A lot of such human generated information is available in forms such as audio (for instance phone calls, radio conversations between responders or responders and victims, etc.) or text (for instance operations command whiteboards, scribed text notes, etc.). In many instances the audio information can be converted to text, via a speech recognizer, for analysis. Analysis of text, particularly the extraction of events from text is thus a prime focus of our work in event extraction. In text extraction we have developed a system and platform for semantic extraction from text which starts from extraction of information from raw reports and documents and goes all the way to high quality extracted information. In audio-visual event extraction we have developed techniques for extraction of information by exploiting simultaneous audio and video streams, a multi-microphone based approach for robust speech recognition, and also an approach to video stream fusion from multiple sources and visual event detection.

3.1

Semantic Extraction from Text

Event information is presented in text streams in many forms. At realtime for instance, we may have textual information streaming in from a scribe at the disaster making observations and notes as the situation unfolds,

Chapter 24. Ashish, et al.

528

or we may have transcribed (audio) conversations between say first responders and operations commanders. Examples of such scribed notes and transcribed conversations are shown in Figure 24-4. ST1:

Sampling team still inside.

COM1: Decon teams head out now. RESP1: Victim 1 shifted to hospital. RESP1: Sampling team, please provide status. ST1: Sampling team task completed, returning to base. Figure 24-4. Transcribed (Responder) Conversations

There are interesting events described in the example text segment in Figure 24-4, for instance we have a report of the event of the Decon teams having left, the Sampling team having completed its task, etc. Then we also have information in text reports that become available post the disaster. For instance a large number of online news reports, postings in blogs, and message boards become available following a disaster. From the awareness perspective we would be interested in tasks such as extraction of facts from such reports (for instance extracting all reports of donation pledges for the affected victims) for further analysis. We are developing a next generation extraction platform, called XAR (Figure 24-5), that performs all tasks in the extraction of information and events from text, starting with raw reports or documents and providing extracted information of high quality and reliability at the end. A key feature of XAR is that the architecture provides for exploiting many “off-the-shelf” and powerful text and language processing systems and tools that have recently become available to the research community; for instance text analysis tools such as GATE [9], and semantic (natural language) parsers such as Shalmaneser [10] and the Stanford Parser [11]. The XAR system allows for building new extraction applications by specifying a ‘schema’ for the infor mation or event to be extracted along with any semantic information that can be provided about the event (such as properties about the different event attributes or ‘slots’). The user may also further provide some processing rules which are essentially logical (Horn Clause based) deductive rules that state what event slot should be filled with what kind of entities. As an example one may define a schema for a donation pledge event

24. Situational Awareness Technologies for Disaster Response

529

to consist of the slots donor, and donor amount. Then we have a rule which states that for instance containing the verb “pledged”, any entity in the sentence which is a country or a relief organization and which appears before the verb pledged, is a value of the donor slot. The system employs the text processors provided to first identify such significant entities in the text and also their features (such as whether it is a country, its relative position in the sentence, etc.) Then, inductive rules are used for the extraction of the detailed information in the event. Such event extraction actually involves several phases such as first classifying which documents or reports could contain the event to be extracted in the first place, then identifying sentences (or groups thereof) that contain the event or are relevant to it, finally slot values are extracted from the sentences; these phases are illustrated in Figure 24-5 below. We have designed XAR to be able to exploit the semantic information (about the event to be extracted) to the maximum extent. This serves to a) Make the extraction rules simpler and b) Handle extraction cases that cannot be handled by pure linguistic analysis.

Figure 24-5. XAR Event Extraction System

Strictly speaking the above kinds of capabilities serve to extricate information i.e., extract no more than the explicitly stated information in text. This leaves us with limitations, for instance, from the text in Figure 244 we can (at best) extract that the location that the victim has been moved to is “the hospital” but not be able to specify which hospital. This is a problem of disambiguation. In many cases, including extraction problems, it is possible to disambiguate such extracted entities. For instance in the above

530

Chapter 24. Ashish, et al.

example we may have further contextual information that helps us infer that “the hospital” referred to is most likely the “UCI Hospital”. XAR includes the capability of improving the quality of extracted information by disambiguation. The disambiguation problem is one which we have originally investigated in the data management context, it arises because objects/entities, such as people, organizations, etc, in real world datasets are often referred to using object descriptions, e.g. person name, which might not serve as unique identifiers of those objects, leading to ambiguity. To solve this problem we have proposed a new domain-independent namedentity disambiguation framework [3,4]. The strength of the framework comes from its ability to analyze inter-object relationships, which the traditional techniques cannot do. The proposed approach views the underlying dataset as a graph of entities, represented as nodes, interconnected via relationships, represented as edges. To decide if two object representations co-refer, or refer to the same real-world entity, the approach analyzes all the relationships that exist between the two object representations by discovering all paths that exist in the graph between the two nodes corresponding to the two object representations. Therefore, the framework analyzes both: the direct relationships that exist among objects, that correspond to the direct edges among the objects, as well as indirect relationships among objects that correspond to paths of length more than one. The proposed disambiguation framework is capable of solving two common types of disambiguation challenges. These types are known under a variety of names in different research communities, we will refer to them as (fuzzy) lookup and (fuzzy) grouping. In the settings of the lookup problem the list of all possible objects in the dataset, along with their descriptions, is provided and the goal is for each reference to pinpoint the exact right object it refers to [3,4,22]. In grouping, there is no such list available and the goal is to simply correctly group references that co-refer [3]. Thus, lookup is a classification problem and grouping is a clustering problem. To solve the lookup problem, the framework discovers the paths that exist among object and it them employs, what is called, a connection strength model to weigh those paths. The outcome of that process is a Nonlinear Programming Problem that needs to be resolved. While it can be solved using a mathematical solver software, we proposed a simple iterative methods that scales better to large problem sizes. Once the problem is solved, the outcome is interpreted to produce the desired mapping of references to objects [4,22]. The framework solves the grouping problem by also measuring the connections strength and attribute similarity among objects. It then combines those measures and employs either merging or correlation clustering algorithm to produce the desired groups of references [3].

24. Situational Awareness Technologies for Disaster Response

3.2

531

Audio-Visual Event Extraction

This area of research focuses on developing robust technologies for extraction of information from all modalities and exploiting multimodality and contextual knowledge for the extraction of situational information. We are developing approaches for both extraction of information from independent single modality streams as well as extraction and fusion of information from multi-modal information streams about a situation. The research areas spanned by this effort on signal interpretation and analysis based on multiple modalities are Robust speech recognition, Speech enhancement, Auditory stream segregation, Audio Visual event detection and modeling, and cross integration areas like emotion detection from speech signals in enhanced QoS for emergency networks. Speech Enhancement using multi microphone speech processing: We have developed techniques for more accurate identification and separation of audio information sources. This is done using a multi-microphone approach. We have developed a robust broadband adaptive beamforming algorithm (for identifying a particular audio signal source), which combines the robustness of the delay and sum (DS) beamforming in the look direction uncertainty with the high interference rejection capability of the conventional adaptive beamforming algorithm [6,7]. Such a broadband adaptive beamforming algorithm is robust to spatially spread sources. A handheld two-microphone array system has been prototyped and deployed in various RESCUE drills. Video-based event detection for enhanced situational awareness: Work in this area is centered around homography, which in computer vision denotes a linear projective transformation that relates two different views of a scene [8]. This is a novel approach to track people and vehicles in crowded scenes using multiple cameras. Camera calibration is not needed in this approach to extract the world coordinates of objects. Object representation and tracking in the homography domain are independent of detailed appearances of the objects, and are an efficient and robust method for handling visual events. Semantic understanding of visual events is achieved by spatio-temporal analysis of the objects in the multiple homography representations.

4.

EVENT DATA MANAGEMENT

Event data management is concerned with providing data management or “database like” capabilities for events. Our aim is to provide a data management system that treats events as first-class objects and provides storage, querying, retrieval, and indexing capabilities for the events. We are

Chapter 24. Ashish, et al.

532

working on several issues in this regard. The first is the issue of event modeling where we have developed a semantic data model for events. Amongst the various attributes we associate with events, there is an important notion of uncertainty of information. Specifically spatial or location uncertainty is something that we have explored in depth. Below we described the work in event modeling as well as in handling spatial uncertainty in events.

4.1

Event Modeling

A semantic data model E, for events is described in [12]. There are some key notions related to events and the event centric approach to situational awareness. For instance a report is the fundamental information source containing event information. A report could be of any modality, for instance an (audio) phone call reporting the event, information in text reports such as text alerts or news stories, or audio-visual information from say a live TV coverage of a situation. A report is defined then as a physical atomic unit that describes one or more events. An event is an instance of an event type in space and time. So an instance of a bridge having collapsed is an example of an event. A situation comprises of a number of events. Events are extracted from reports. An entity is an object that occupies space and exists for an extended period of time. Events generally have entities, such as people, objects (such as say cars or planes), etc. associated with them. For instance a vehicle overturning event will have the particular vehicle overturned as one of the entities associated with that event. A milieu is the spatial, temporal or spatio-temporal context in which an event, an object or report is situated. Continuing with the bridge collapsing event example, the time and place where the incident occurred are milieus associated with the event. Note that we have deliberately separated the notion of an event from a specific media, an event may certainly be related to a media (that it is captured in and extracted from) however the event itself is an event per se and not a “text event” or an “audio event”. We now describe the spatial uncertainty work.

4.2

Spatial Awareness and Indexing

When reasoning about events and situations, location is a key attribute for understanding. To deal with the spatial aspects of events, we have proposed an approach to model and represent (potentially uncertain) event locations described by human reporters in the form of free text [13]. In addition, we have analyzed several types of spatial queries of interest in the

24. Situational Awareness Technologies for Disaster Response

533

context of awareness applications. As a motivating example, consider the excerpts from two real reports filed by Port Authority Police Department (PAPD) Officers who participated in the events of September 11th, 2001: "... the PAPD Mobile Command Post was located on West St. north of WTC and there was equipment being staged there ..." "... a PAPD Command Truck parked on the west side of Broadway St. and north of Vesey St. ..." These two reports refer to the same location of the same command post -a point-location in the New York, Manhattan area. However, neither the reports specify the exact location of the events, nor do they mention the same street names. We would like to represent such reports in a way that it enables efficient evaluation of spatial queries and analyses. For instance, the representation must enable us to retrieve events in a given geographical region (e.g., around World Trade Center). Likewise, it should enable us to determine similarity between reports based on their spatial properties; e.g., we should be able to determine that the above reports might refer to the same location. Our goal is to represent uncertain locations specified in reports to allow for effective execution of analytical queries. Clearly, merely storing location in the database as free text is not sufficient either to answer spatial queries or to disambiguate reports based on spatial locations. For example, spatial query such as "retrieve events near WTC", based on keywords alone, can only retrieve the first report mentioned earlier. To support spatial analyses on free text reports, we need to project the spatial properties of the event described in the report onto the domain. We do so by modeling uncertain event locations as random variables that have certain probability density functions (pdfs) associated with them. We have developed techniques to map free text onto the corresponding pdf defined over the domain. When the exact address of the event is available, there are many ready solutions that can allow to map it into the corresponding point inside the domain. We instead focus on another relatively frequent case where people report event locations based on certain landmarks. Landmarks correspond to significant spatial objects such as buildings, streets, intersections, regions, cities, areas, etc. embedded in the space in which the events or situation are immersed. Spatial location of events specified in those reports can be mapped into spatial expressions (s-expressions) that are, in turn, composed of a set of spatial descriptors (s-descriptors) (such as near, behind, infrontof, etc) described relative to landmarks. Usually, the set of landmarks, the ontology of spatial descriptors, and the precise interpretations of both are domain and context dependent. Table 24-1 shows excerpts of

Chapter 24. Ashish, et al.

534

free text referring to event locations and the corresponding spatial expressions. Table 24-1. Examples of s-expressions free text ‘near WTC’ ‘on West St., north of WTC’

s-expression near(WTC) on(West St.) Ù north(WTC)

These expressions use WTC and West St. as landmarks. While the locations of landmarks are precise, spatial expressions are inherently uncertain: they usually do not provide enough information to identify the exact point-locations of the events. Our approach to representing uncertain locations described in free text consists of a two-step process. First, a location specified as a free-text is mapped into the corresponding sexpression, which in turn is mapped to its corresponding pdf representation. Given such a model, we have also developed techniques to represent, store and index pdfs to support spatial analysis and efficient query execution over the pdf representations [15,16]. This allows to have complex representations of (location) uncertainty but at the same time support complex queries over such representations efficiently.

5.

EVENT ANALYSIS AND VISUALIZATION

Analysis and visualization is concerned with providing intuitive and (possibly) visual analysis and querying capabilities for end users of situational information. It is reasonable to expect that end users of such systems, such as EOC managers or field commanders would finally like to see patterns and trends in the information collected and get intuitive and visual views of the information (say overlayed over maps etc.). In this regard we have developed tools such as a graph based query algebra and language over events which enables us to query and analyze events in a graphical manner. We have also developed techniques and systems in the area of predictive modeling, that we have applied to tasks such as people estimation and route prediction. We describe these below.

5.1

Semantic Graph Query and Analysis

A large collection of text reports are generated during a disaster. In its original form, this data is of limited use since the user can apply only keyword based search. Although event/entity extraction can be employed to extract events, related entities and inter-event relationships to produce a more structured data, the extracted semi-structured data still does not fit the

24. Situational Awareness Technologies for Disaster Response

535

traditional tabular representation and hence most existing exploratory and analytical tools can not be readily applied (in most cases). Our semantic graph query and analysis research aims at developing techniques tailored to analyzing such data. Once events and entities, their attributes and their relationships are extracted from various textual sources, they need to be represented using a generic data model that is amenable for more sophisticated query and analysis. Semantic graphs which capture data at the lowest semantic granule provide such a common representation. The nodes in such a graph correspond to uniquely identified events, entities, their attribute values and source reports. The edges correspond to a variety of semantic relationships among the nodes. In addition to extracted data, semantic graphs are also used to represent domain knowledge in the form of taxonomies and ontologies which can be used in the query and analysis of the data. This ability of semantic graphs to symmetrically represent both extracted data and domain knowledge makes them ideal for a variety of disaster report analysis tasks. For instance, Figure 24-6 provides an illustration of the use of graphs for analyzing news reports (of a disaster). We have nodes (of different colors) representing entities such as news stories, news sources, news topics etc. and the graph edges depict relationships amongst them. The graphical representation is more intuitive and powerful for end users, for instance one can visually see correlations between news stories and sources and news topics, correlations with and over certain periods of time etc. Below we discuss three ways in which our research is extending current technology to enable query and analysis on semantic graphs. (1) Query Algebra: We have developed a query algebra, called Graph Analytic Language (GAL), which offers a number of features to enable analysis of semantic graphs including graph-aware aggregation and grouping, well-defined integration of graph and set-based operations, operators to interface with ontology inference engines as well as a variety of bulk operators [17]. These operators enable us to pose analytical queries similar in spirit to OLAP queries (for example, over events at multiple levels of composition/ resolution). (2) Exploratory Analysis Operators: We have developed a number of exploratory analysis operators (and their implementation algorithms), that enable the identification of taxonomy concepts that best summarize a set of reports, or best differentiate or associate a pair of report collections, for example from two disaster incidents [17,18]. (3) Semantic Relationship Analysis: We have developed a version of the OLAP cube operator (called Multi-Relational Iceberg-Cubes) that enables the user to detect entity attribute values that characterize prominent semantic relationships among them [17].

Chapter 24. Ashish, et al.

536

Figure 24-6. Graph Analysis of Events

5.2

Predictive Modeling

Another key aspect of analysis, particularly in disasters, is the ability to predict and estimate certain things. For instance, an estimation of the current location and number of people in a disaster area and a prediction of the future movement of those people could provide critical information to EOC (Emergency Operations Command) personnel responsible for rescue and evacuation, and also to members of the public looking for the best way to navigate to their desired destination. We are using statistical models and bayesian techniques to extract information about human behavior from a variety of “human detection” sensors such as loop sensors counting cars on a freeway, people counters at doors to buildings and GPS devices on cellphones or cars. Our aim is to enable the creation of a “People Forecast” similar to a weather forecast that, instead of giving current weather conditions and a prediction of the weather throughout the rest of the day, gives an easily interpretable picture of the current condition of the population (such as the location and density of people in an area, indications of unusual behavior or unusual events taking place) and also a prediction of where people will be moving in the near future. We are working on two

24. Situational Awareness Technologies for Disaster Response

537

projects, one dealing with situational analysis and estimation of current conditions and the other dealing with predicting future movement of people. .

5.3

Situational Assessment/Current conditions

Occupancy analysis in real time is a difficult problem that has not been approached in a systematic way to our knowledge. Current approaches to large scale estimation of the number of people in a given area often use dated census information, perhaps with some simple adjustment for daytime versus nighttime predictions. No current approaches appear to use real-time measurements of human activity such as freeway traffic information given by loop sensors on highways to influence their predictions. While occupancy analysis remains a difficult problem, we have identified smaller sub-problems that also give useful information, and we have had some success in extracting interesting and useful information. The first problem we identified is detecting unusual activity or events from sensors that measure human activity in some form such as people counters or freeway sensors.

observed:36;lamb-da: 13.2 ;prediction: 1,000 Last Update: Aug 28 13:30

Figure 24-7. Anomalous Event Detection

Our algorithm learns (unsupervised) normal traffic patterns and detects "event" activity defined as short bursty periods of unusually high or low traffic in real time using a time varying Poisson process model. The output of the inference algorithm is a probability that an event is taking place at any

Chapter 24. Ashish, et al.

538

given time, along with an estimate of the extra number of people or cars or whatever you are counting that are attributed to that event Also, we are creating software for a real time event detection system for freeway traffic in southern California. Users will be able to log on to a website that will display a map of the area of interest that shows current event activity and a history of event activity (see screen-shot below). As an example of how this could be used in an EOC center, imagine evacuation planning during a bomb threat to downtown LA; the real-time event detection system is brought up, events at off-ramps in the past 3 hours is selected, and all off ramps near Dodgers stadium indicate the presence of an event, furthermore an extra 20,000 cars are predicted to have used those off ramps above the normal traffic; this gives a quick indication that something is going on in Dodgers stadium as well as an idea of the popularity of the event. Our second project deals with modeling car travel activities of individuals using GPS data. In particular, we have developed a probabilistic model that answers the following questions about individuals: 1. Given the current time, where the individual is most likely to be (e.g. his home, office or traveling). 2. Given the current time, where the individual is most likely to go (e.g. pick up his kids from the day-car center, grocery shopping etc). 3. Given that the person is traveling, which route the individual is most likely to take to the destination.

Figure 24-8. Route Prediction

Our probabilistic model [19,20,21] is accurate almost 84% of the time in predicting the most likely destination/location of a typical individual and thus could provide valuable information to first responders and transportation planners in planning evacuation. Our hope is that even if a

24. Situational Awareness Technologies for Disaster Response

539

small sample of the traveling public agreed to collect their travel data and make that data publicly available, transportation management systems could significantly improve their operational efficiency. We also envision our probabilistic model to be used in devices like “personal traffic assistants” that run on the mobile devices which could help travelers re-plan their travel when the routes they typically use are impacted by failures in the system arising from accidents, terrorist attacks and natural disasters such as earthquakes. In Figure 24-8, we show a typical execution of our system. On the left is the person’s current location derived from the GPS device on his car/cellphone and on the right is the route the person is most likely to take based on his past history (predicted by our model).

6.

ARTIFACTS

In addition to research, a key aspect of all RESCUE projects, including situational awareness, is the development of representative artifacts that are essentially practical demonstrations of our technology capabilities, and driven by first responder needs. In situational awareness we are pursuing the development of two such artifacts at the conceptual level. One is a conception of an “information dashboard” which is essentially an integrated dashboard of processed, integrated, multi-modal information that can be used for decision making and the other is a real-time multi-modal reconnaissance system that can be employed in real-time data collection and extraction. Here we describe our work on the situational dashboard.

6.1

The Situational Dashboard

This artifact is aimed at facilitating awareness from multi-modal data and enabling end-users to apply situational information in decision-making and analysis. The situational dashboard provides integrated and fused information from multiple sources and provides analysis, querying, triaging and filtering functionality. Such a system can provide, say, an EOC with an awareness of events as they unfold. Emergency managers can use the information processed for planning, analysis and logistics tasks. For instance, information about traffic conditions and also the location of people or vehicles can be used for analysis such as evacuation and route planning. Clusters of information can be used for damage and impact assessment. It can be used to dispatch search and rescue and support logistical needs. We are developing different actual manifestations of the dashboard concept. These include a set of disaster information portals that provide

540

Chapter 24. Ashish, et al.

integrated online access to a variety of useful information, to both citizens as well as responders in a crisis. In conjunction with the City of Ontario, CA, we are developing a web-based portal (Figure 24-9) for dissemination of information to that community. This information includes real-time details of incidents and response, as well as the status of public infrastructure, such as roadways. During large-scale events the information to be shared can include general announcements, maps, emergency shelter information, family reunification assistance, management of donations and volunteer resources, etc. Other capabilities we have developed include the ability for users to perform searches for the whereabouts of displaced family and friends, traffic flow monitoring and identification of anomalous events, and an automated system by which local businesses and organizations can sign up to receive customized information during an incident via a number of modalities including web, phone, or SMS.

Figure 24-9. Ontario Disaster Portal Interface

The other portal instantiation is a Hurricane Portal for large scale disaster. During such disasters it can be difficult for first responders groups as well as the public to extract a good level of situational awareness from the vast amount of information which is quickly generated by media as well as individuals. The RESCUE Hurricane Portal aims to vastly improve access to information of use to these groups, especially during the first several days after a hurricane makes landfall. The initial portal is focused on developing tools to help users find pertinent data from the Web, eyewitnesses, and computer simulations, and aiding in transforming the found data into information which is actionable for the purpose of minimizing negative

24. Situational Awareness Technologies for Disaster Response

541

impact of the event to people and property. A key capability in this application is the development of multi-dimensional, faceted web search, analysis, and visualization capabilities which are customized to the disaster management subject domain. We are aiming to release test versions of both these portals in the coming months, also we are taking active and regular guidance from responders and emergency response organization personnel affiliated with RESCUE in the development.

7.

CONCLUSION

We described above our work in many areas towards a situational awareness system for disaster response. From the application perspective, our interactions with the first-responder community as well as our field work with the emergency organizations have led us to identify the key challenges in situational awareness. First, sometimes the information is almost entirely missing or so uncertain that it is impossible to meaningfully ascertain the situation. This is usually the case in the immediate aftermath of the disaster. An approach to improve situational awareness in such a case is better preparedness – e.g., deploying sensing equipment that can provide an early synopsis of the damage, etc. maintaining accurate information about resources, vulnerabilities, etc. so that accurate predictions can be made even in the absence of field level data. Second, situational information often arrives across multiple modalities at different times in an uncorrelated fashion from diverse sources. While there is an avalanche of data, much of it is underutilized since there do not exist any tools that support seamless access to useful actionable information in a timely fashion. The situational awareness technologies we have described in all the tiers i.e., event extraction, event data management and event analysis are aimed at addressing exactly this problem of converting available data to actionable information. Third, much of the information is human generated (e.g., by first responders, citizen journalists, etc.). While such information has the advantage of human interpretation, it could also suffer from cognitive bias and misinterpretation by humans. Technologies to leverage such humangenerated information in a robust timely manner do not exist. Furthermore, even if such tools existed, the impact of taking actions based on such information is unclear. Also such information is usually “report-centric”. To make the information useful for decision making there is a need to make the information “situation-centric” through processing. The event-centric approach that we are developing to situational awareness serves to convert the report-centric information to information at the event and situation level

Chapter 24. Ashish, et al.

542

of abstraction. Finally, information required to gain situational awareness often resides across different organizational boundaries with restrictions on their availability and policies for sharing. Tools for seamless sharing of information across information silos do not exist. We are addressing this problem as part of the policy based information sharing project described in the introduction. The applicability of our research thus goes to the core of the advancements required for next-generation situational awareness systems in disaster response; our hope is to be able to advance the state-of-the-art in situational awareness technology as well as impact first responders in emergency organizations.

8.

ACKNOWLEDGEMENTS

We have described the work of several researchers and students working on the situational awareness technologies project in RESCUE. We wish to acknowledge these members who have made key contributions to the research as well as to the writing of this chapter. These include Rina Dechter, Ron Eguchi, Vibhav Gogate, Jon Hutchins, Charles Huyck, Yiming Ma, Sangho Park, Bhaskar Rao, Dawit Seid, Shankar Shivappa, Mohan Trivedi and Wenyi Zhang.

REFERENCES [1]

[2]

[3] [4] [5]

[6]

Sharad Mehrotra, Carter Butts, Dmitri Kalashnikov, Nalini Venkatasubramanian, Ramesh Rao, Ganz Chockalingam, Ron Eguchi, Beverly Adams and Charles Huyck. Project Rescue: Challenges in Responding to the Unexpected. IS&T/SPIE 16th Annual Symposium on Electronic Imaging. January 18–22 2004, San Jose, California, USA, 2003-12. Dmitri Kalashnikov, Dawit Seid, Yiming Ma, Naveen Ashish, Sharad Mehrotra and Nalini Venkatasubramanian. Event Based Approach to Situational Awareness. Calit2 Report, UC Irvine. Zhaoqi Chen, Dmitri V. Kalashnikov, Sharad Mehrotra: Exploiting relationships for object consolidation. IQIS 2005: 47-58. Dmitri V. Kalashnikov, Sharad Mehrotra, Zhaoqi Chen: Exploiting Relationships for Domain-Independent Data Cleaning. SDM 2005. Reynold Cheng, Dmitri V. Kalashnikov, and Sunil Prabhakar. Evaluating probabilistic queries over imprecise data. In Proc. of ACM SIGMOD Int'l Conf. on Management of Data (ACM SIGMOD), June 9-12, 2003. Wenyi Zhang and Bhaskar Rao. Robust Broadband Beamformer with Diagonally Loaded Contraint Matrix and its Application to Speech Recognition, IEEE International Conference on Acoustics, Speech, and Signal Processing, ICASSP-2006, Toulose, France.

24. Situational Awareness Technologies for Disaster Response [7]

[8]

[9]

[10] [11]

[12]

[13]

[14]

[15]

[16]

[17] [18] [19]

[20]

[21]

[22]

543

Wenyi Zhang and Bhaskar Rao. Robust Adaptive Beamformer with Feasibility Constraint on the Steering Vector, European Signal Processing Conference, EUSPCO2006, Italy. S. Park, M. M. Trivedi. A Track-based Human Movement Analysis and Privacy Protection System Adaptive to Environmental Contexts. Proc. IEEE International Conference on Advanced Video and Signal based Surveillance, Sep 2005. H. Cunningham, D. Maynard, K. Bontcheva, V. Tablan. GATE: A Framework and Graphical Development Environment for Robust NLP Tools and Applications. Proceedings of the 40th Anniversary Meeting of the Association for Computational Linguistics (ACL'02). Philadelphia, July 2002. K. Erk and S. Pado. Shalmaneser - a flexible toolbox for semantic role assignment. Proceedings of LREC-06, Genoa. Dan Klein and Christopher D. Manning. Fast Exact Inference with a Factored Model for Natural Language Parsing. In Advances in Neural Information Processing Systems 15 (NIPS 2002), December 2002. Bo Gong, Utz Westermann, Srikanth Agaram and Ramesh Jain. Event Discovery in Multimedia Reconnaissance Data Using Event Clustering. AAAI Workshop on Event Extraction and Synthesis, Boston MA, July 2006. Dmitri V. Kalashnikov, Yiming Ma, Sharad Mehrotra, Ram Hariharan, Nalini Venkatasubramanian, and Naveen Ashish. SAT: Spatial Awareness from Textual Input. In Proc. of Int'l Conf. on Extending Database Technology (EDBT), demo publication, March 26–30, 2006. S. Mehrotra, C. Butts, D. Kalashnikov, N. Venkatasubramanian, K. Altintas, et al. CAMAS: A Citizen Awareness System for Crisis Mitigation. In Proc. of ACM SIGMOD Int'l Conf. on Management of Data (ACM SIGMOD), demo publication, June 13-18, 2004. Dmitri V. Kalashnikov, Yiming Ma, Sharad Mehrotra, and Ram Hariharan. Index for Fast Retrieval of Uncertain Spatial Point Data. In Proc. of Int'l Symposium on Advances in Geographic Information Systems (ACM GIS), November 10-11, 2006. Dmitri V. Kalashnikov, Yiming Ma, Sharad Mehrotra, and Ram Hariharan. Modeling and Querying Uncertain Spatial Information for Situational Awareness Applications. In Proc. of Int'l Symposium on Advances in Geographic Information Systems (ACM GIS), November 10-11, 2006. Dawit Seid and Sharad Mehrotra. Algebraic Support and Optimization for Semantic Queries. RESCUE technical report, 2006. Dawit Yimam Seid and Sharad Mehrotra. Efficient Relationship Pattern Mining Using Multi-Relational Iceberg-Cubes. ICDM, 2004, pp. 515-518. Vibhav Gogate, Rina Dechter, Bozhena Bidyuk, Craig Rindt and James Marca. Modeling Transportation Routines using Hybrid Dynamic Mixed Networks. In Uncertainty in Artificial Intelligence 2005. Vibhav Gogate and Rina Dechter. Approximate Inference Algorithms for Hybrid Bayesian Networks with Discrete Constraints. In Uncertainty in Artificial Intelligence 2005. Vibhav Gogate, Rina Dechter, Bozhena Bidyuk, Craig Rindt, and James Marca. Model-ing Travel and Activity Routines using Hybrid Dynamic Mixed Networks. In 85th annual meeting of the Transportation Research Board, 2006. Dmitri V. Kalashnikov, Sharad Mehrotra. Domain-independent data cleaning via analysis of entity-relationship graph. ACM Transactions on Database Systems 31(2): 716-767 (2006).

544

Chapter 24. Ashish, et al.

ONLINE RESOURCES · RESCUE Project, http://www.itr-rescue.org/ · Federal Emergency Management Agency (FEMA), http://www.fema.gov · Community Emergency Response Team, Los Angeles, California, http://www.cert-la.com/index.shtml · New York State, State Emergency Management Office (SEMO), http://www.semo.state.ny.us/ · American Red Cross, http://www.redcross.org/

QUESTIONS FOR DISCUSSION 1. What are the limitations of the relational data model for representing situations and events ? 2. How can semantics and knowledge play a role in situational information systems; in all the three SA system aspects, namely signal analysis and synthesis, situational data management, and analysis ? 3. What should be the capabilities for a next-generation data management system that can store, manage, and reason with situational information?

AUTHOR INDEX Abbasi, Ahmed ............................. 285

Nunamaker, Jay F., Jr.....................495

Ashish, Naveen ............................. 517

Qin, Jialun............................. 221, 237

Balasubramanian, Niranjan............ 407

Raphael, Sam...................................51

Best, Clive .................................... 115

Reid, Edna.................. 3, 221, 237, 267

Bobeica, Mihaela........................... 115

Rumm, Peter.................................. 385

Burgoon, Judee K. ........................ 495

Sageman, Marc..............................221

Chang, Kuiyu ............................... 309

Salem, Arab...................................267

Chau, Michael............................... 473

Schneider, Moti .............................365

Chen, Hsinchun... 3, 221, 237, 267, 285

Seo, Young-Woo ...........................451

Eguchi, Ronald.............................. 517

Shahar, Yael ..................................157

Ellis, James O., III......................... 141

Shapira, Bracha..............................365

Elovici, Yuval ............................... 365

Silke, Andrew..................................27

Fienberg, Stephen E....................... 197

Sinai, Joshua..................................101

Friedman, Menahem...................... 365

Skillicorn, David B. ......................425

Garcia, Teofilo .............................. 115

Smyth, Padhraic............................. 517

Gunaratna, Rohan Kumar .............. 309

Sun, Zhen ......................................309

Hegde, Rajesh ............................... 517

Suryanto, Maggy Anastasia ............309

Horgan, John................................... 73

Sycara, Katia .................................451

Hu, Xiaohua.................................. 385

Symonenko, Svetlana.....................407

Huyck, Charles.............................. 517

Trujillo, Horacio R.........................175

Jackson, Brian A. .......................... 175

Venkatasubramanian, Nalini...........517

Jensen, Matthew L......................... 495

Wu, Daniel ....................................385

Jéral, Jean-Paul ............................. 115

Xu, Jennifer ...................................473

Kalashnikov, Dmitri ...................... 517

Xu, Shuting ...................................347

Kandel, Abraham .......................... 365

Yilmazel, Ozgur.............................407

Kruse, W. John.............................. 495

Zaafrany, Omer..............................365

Last, Mark .................................... 365

Zhang, Jun.....................................347

Liddy, Elizabeth D. ....................... 407

Zhang, Xiaodan .............................385

Lim, Ee-Peng ................................ 309

Zhou, Xiaohua ...............................385

Mehrotra, Sharad........................... 517

Zhou, Yilu ............................. 221, 237

Meservy, Thomas O. ..................... 495

545

SUBJECT INDEX - Numbers 9/11 attacks.... 27, 28, 43, 46, 73, 148, 197, 198, 199, 200, 224, 241, 366, 367, 426, 533 -Aabsolute deprivation theory............................................................................... 104 ad hoc cells ...................................................................................................... 143 ad hoc terrorist groups...................................................................................... 171 affect ambiguity ................................................................................ 292, 294, 304 affect analysis ................................................................................... 285, 286, 295 affect feature ...................................................................... 292, 293, 294, 296, 297 affect intensities ....................286, 289, 290, 292, 293, 294, 296, 297, 298, 300, 303 affect lexicon ...................................................... 285, 286, 292, 294, 295, 299, 303 Afghanistan....................................................................................... 134, 135, 161 Africa ......................................................................................... 38, 117, 125, 126 agents of mobilization ...................................................................................... 104 aggression........................................................................................ 104, 291, 293, al-Aqsa Intifada................................................................................................ 110 alarm thresholds values .................................................................................... 376 Albania ............................................................................................................ 110 Algeria.............................................................................................. 111, 134, 135 al-Qaeda .......................... 38, 39, 40, 43, 46, 47, 111, 170, 171, 225, 230, 231, 235, 242, 268, 318, 326, 329, 331 al-Qaeda database ............................................................................................ 152 al-Qaida ............................................................................................. See al-Qaeda amateur terrorists ............................................................................................. 143 An Garda Síochána .......................................................................................84, 90 anger................................................................................................. 104, 290, 291 armed assault ................................................................................................... 143 assassination ....................................................................................... 42, 117, 143 autonomy......................................................................................................... 143 -Bbacteria mining .........................................................................................392, 399 bag-of-words....................................................... 407, 410, 416, 419, 420, 431, 432 Basque ETA....................................................................................................... 77 Beirut, Lebanon ............................................................................................... 165 Benin ................................................................................................ 126, 127, 128 Bin Laden, Osama............................................. 3, 16, 111, 232, 270, 279, 360, 361 biological agents .......................................................................................386, 387 biological weapons.............................................. 176, 386, 387, 390, 412, 414, 418 blog hosting sites........................................................................437, 474, 476, 481

547

548

Subject Index

blogs................................. ..269, 290, 291, 473, 474, 475, 476, 479, 480, 481, 483, 484, 485, 488, 489, 524, 528 bombing...............................143, 164, 186, 272, 274, 276, 277, 303, 310, 311, 326, bombs ......................................................................................... 78, 183, 185, 279 BOW ..........................................................................................See Bag-of-words Burkina Faso.............................................................................................127, 137 Burundi............................................................................................................ 126 Burundi Hutu FNL ........................................................................................... 126 -Ccarbombs .................................................................................... 42, 165, 166, 167 CBRN...................... See Chemical, Biological, Radiological and Nuclear Weapons Central African Republic.................................................................................. 137 Central Intelligence Agency (U.S.) .................................................... 198, 200, 415 centrality.................................................................... 11, 52, 54, 66, 481, 482, 487 Chad ..........................................................................................126, 127, 128, 137 Chechnya ......................................................................................................... 110 Chemical, Biological, Radiological and Nuclear weapons .........42, 43, 44, 102, 108 CIA............................................................. See Central Intelligence Agency (U.S.) citation data ..................................................................................................3, 5, 6 civil protections................................................................................................ 103 classification methods ....................................................................... 456, 461, 469 cluster analysis.................................................................................. 368, 369, 370 clustering coefficient ......................................................................... 481, 486, 487 co-citation data...................................................................................... 6, 8, 11, 17 coding schemes ........................................... 118, 228, 233, 247, 268, 274, 275, 280 coercive measures ............................................................................................ 109 Colombia ......................................................................................................... 111 combating terrorism ........................................................... 103, 107, 108, 109, 110 command structure............................................................................ 88, 93, 94, 95 communication and control ............................................................... 222, 518, 521 communication and control networks................................................................ 518 communication and information infrastructures ................................................ 520 communications paths ...................................................................................... 184 computer mediated communication ...........................................................286, 479 confidential information ........203, 347, 451, 452, 453, 454, 456, 458, 459, 462, 463, 468, 469 conflict assessment........................................................................................... 115 conflict indicators.............................................................................. 117, 124, 136 conflict monitoring........................................................................................... 117 conflict triggers................................................................................................ 117 Congo.............................................................................................................. 126 content analysis...................6, 20, 222, 224, 225, 226, 228, 233, 237, 238, 242, 246, 262, 263, 267, 269, 271, 272, 273, 276, 280, 281, 286, 287, 288, 290, 293, 368 content map analysis .......................................................... 3, 4, 6, 8, 10, 15, 20, 21 content richness............................ 237, 239, 241, 242, 243, 247, 248, 253, 254, 262 content richness attributes................................................................................. 246

Subject Index

549

conventional weapons warfare.......................................................................... 102 cost-sensitive classification................................................................ 453, 459, 468 cost-sensitive learning ........................................................ 459, 460, 461, 464, 469 counterterrorism analysis............................................ 175, 176, 178, 186, 195, 196 counter-terrorism plan ...................................................................................... 158 Country Reports on Terrorism .......................................................................... 148 Country Risk Profiles ....................................................................................... 118 -Ddata collection................. 35, 117, 118, 119, 145, 146, 196, 348, 352, 457, 467, 539 Data distortion ................................................................................................. 347 Data Distortion................................................................................................. 347 data distortion method ...................................................................................... 353 data distortion methods............................................... 349, 350, 358, 359, 361, 364 data distortion techniques ................................................................................. 349 data management ....................................................... 525, 526, 530, 531, 542, 544 data matrix................................................................. 350, 351, 354, 361, 437, 438 data mining ....................................... .172, 173, 197, 198, 199, 200, 205, 206, 207, 210, 212, 218, 347, 348, 349, 350, 351, 352, 357, 361, 362, 381, 387, 409, 477 data mining techniques...............................................................199, 349, 357, 478 data privacy ................................................ 205, 212, 349, 350, 352, 354, 361, 364 decentralized decision-making.......................................................................... 143 deception detection....................................................................................496, 499 deception score .........................................................................................434, 446 degree distribution.....................................................................................481, 486 Democratic Republic of Congo..................................................................126, 137 Department of Homeland Security (U.S.).................... 152, 153, 198, 202, 218, 389 Department of Homeland Security (U.S.), University-Based Centers of Excellence ....................................................... 152 descriptive statistics ........................................................................................... 46 detection algorithm....................... 365, 366, 369, 370, 372, 376, 377, 378, 379, 381 detection system.........................................................................120, 382, 426, 538 DHS.................................................. See Department of Homeland Security (U.S.) disclosure limitation ............................................ 195, 200, 205, 207, 208, 209, 210 discriminant analysis ..................................................................495, 509, 510, 511 disease outbreak detection ................................................................................ 116 disease surveillance.......................................................................................... 404 diseases...................................................................... 386, 388, 389, 394, 404, 406 distributed noise................................................................................ 351, 358, 360 document ranking................................................ 317, 321, 324, 330, 331, 332, 341 document ranking strategies ................ 309, 312, 313, 319, 320, 321, 322, 323, 324, 325, 328, 329, 330, 331, 332, 333, 335, 337, 338, 341, 343 document representation............................................. 410, 411, 414, 416, 418, 420 document vector................................................................................ 409, 414, 416 domestic terrorism............................................................................. 145, 148, 149 Domestic Terrorism database............................................................................ 152

550

Subject Index

-Eearly warning system.................................................................................117, 118 Earth Liberation Front .................................................................................39, 186 EBSCO............................................................................................................ 148 economic dependence....................................................................................... 136 economic disparity ........................................................................................... 117 Eco-terrorism database ..................................................................................... 152 Egypt ............................................................................................................... 111 electoral fraud .................................................................................................. 117 emergency management ................................................................................... 148 EMM ............................................................................ See Europe Media Monitor entity class .................................................................................318, 329, 330, 331 entity instances.............................. 310, 312, 313, 317, 318, 319, 321, 322, 323, 324, 325, 328, 329, 330, 331, 332, 337, 338 entity relation graph .......................................................................... 310, 326, 331 Environment Degradation................................................................................. 136 equal rights ...................................................................................................... 103 Europe Media Monitor ........................115, 116, 118, 120, 121, 122, 123, 124, 131, European Commission ..............................................................................115, 116 European Union Common Foreign and Security ............................................... 116 event data.......................................................................................... 118, 531, 542 event detection ........................................................... 316, 317, 527, 531, 537, 538 event extraction................................................................................. 527, 529, 542 event databases ................................................................................................ 146 External Relations Directorate General ............................................................. 115 external threats........................................................... 123, 125, 126, 129, 131, 136 extraction patterns.............................................. 312, 314, 315, 316, 319, 320, 321, 323, 324, 325, 328, 329, 330, 331, 341, 344 extremist group forums........................................ 259, 285, 286, 292, 293, 298, 307 extremist ideology............................................................................................ 105 -FFARC (Colombia).............. See Revolutionary Armed Forces of Colombia (FARC) FAST............................................................................................................... 118 Fatah................................................................................................................ 111 FBI ........................................................See Federal Bureau of Investigation (U.S.) feature extraction ......................................................................................233, 502 feature vectors............................................................ 203, 204, 296, 391, 392, 416 Federal Bureau of Investigation (U.S.)................................ 149, 198, 242, 244, 329 federal criminal cases ....................................................................................... 149 first responders....................................................148, 521, 522, 528, 538, 540, 542 Foreign Broadcast Information Service............................................................. 148 foreign policy analysis...................................................................................... 115 former terrorists ................................................................................................. 76 freedom ........................................................................................................... 103 free-floating cells ............................................................................................. 143 frustration ........................................................................................................ 104

Subject Index

551

funding for terrorism studies............................................................................... 33 fundraising (by/for terrorist groups)........................... 79, 80, 81, 83, 84, 87, 91, 92, 93, 94, 95, 142, 160, 228, 238, 240, 277, 280, -GGama’ah al-Islamiya ........................................................................................ 162 Gaza Strip........................................................................................................ 112 gender.......................................................................................................479, 485 general text parser ............................................................................................ 121 giant component.........................................................................485, 486, 487, 488 Global Terrorism Database............................................................................... 152 Global War on Terror ....................................................................................27, 44 group learning......................................175, 177, 184, 187, 188, 189, 190, 195, 196 guerrilla .....................................................................................108, 238, 239, 243 -HHamas........................................................... 40, 106, 111, 112, 228, 230, 231, 239 hate affect ..................................................................................297, 298, 300, 302 hate groups.......................................... 239, 243, 286, 473, 474, 475, 479, 480, 483, 484, 485, 488, 489, 493 Hezbollah.................................................................................... 40, 180, 231, 239 hierarchical clustering algorithm......................................................................... 10 hierarchical clustering methods......................................................................... 478 hijackers ............................................................................................. 42, 198, 212 hijackings................................................................................................9, 42, 143 historic oppression ........................................................................................... 117 Hizballah ......................................................................................... See Hezbollah homeland security ............................................... 148, 200, 214, 348, 367, 387, 404 hostage-taking.................................................................................................. 143 hyperlinked communities ................................................... 225, 227, 230, 231, 233 -IICT .................................................................................................................. 160 ICT database of terrorist incidents .................................................................... 172 ideology.............................................................. 149, 160, 222, 231, 280, 473, 475 ideological aspects of terrorism ........................................................................ 143 imprisoned terrorists........................................................................................... 76 inferential statistics...................................................................... 27, 35, 36, 38, 47 Infidels......................................................................................................229, 244 influenza ........................................................................................... 395, 397, 398 influenza vaccines ............................................................................................ 397 information extraction ......................... 202, 309, 310, 312, 314, 325, 328, 349, 473, 477, 481 information overload ........................................................................................ 116 insider threats.......................................368, 407, 408, 411, 452, 454, 458, 469, 472 intelligence agencies .................................................................................176, 182 intelligence analyst............................................................................ 187, 191, 454

552

Subject Index

intelligence community .................................................................................... 175 intelligence data ................................................................. 187, 189, 190, 196, 201 intelligence stream ........................................................................................... 188 intercoder reliability ......................................................................................... 147 interdisciplinary nature of terrorism research .................................................... 144 International Centre for Political Violence & Terrorism Research database ....... 152 International Counter-Terrorism Academic Community.................................... 152 International Policy Institute for Counter-Terrorism/Merari database ................ 152 International Relations and Security Network ................................................... 152 international terrorism ...................................................................... 145, 149, 152, International Terrorism: Attributes of Terrorist Events...................................... 152 Inter-University Consortium for Political and Social Research .......................... 152 interviews with the IRA...................................................................................... 79 interviews, use of, for terrorism studies............................................................... 75 Intifada ............................................................................................................ 230 Iran ...........................................................................................................105, 138 Iraq.......................................................45, 110, 129, 130, 138, 161, 178, 274, 277, 278, 291, 303, 326, 412, 417, 418, 419, 420 Ireland ............................................................................................................... 39 Irish Republican Army (IRA) ........................................... 39, 78, 93, 179, 180, 182 Islamic Jihad........................................................................ 40, 111, 228, 230, 231 Islamist extremists............................................................................................ 170 Islamist terrorism ............................................................................................... 39 Israel.................................................................................... 40, 106, 110, 111, 138 Israeli settlements............................................................................................. 106 Joint Research Center (European Commission)..........................................115, 122 Jordan .............................................................................................................. 111 JRC.................................................................................See Joint Research Center -K Kansas Event Data System (KEDS).................................................................. 118 Kenya ............................................................................................... 127, 128, 137 kidnapping ....................................................................................................... 143 knowledge mapping ............................................................................ 3, 4, 6, 8, 21 Kurds............................................................................................................... 110 -Llanguage processing ..................................................................................314, 528 lassa fever ........................................................................................................ 397 latent semantic analysis ...................................................... 115, 116, 119, 120, 411 Latin America ............................................ 238, 239, 243, 244, 245, 249, 250, 251, 252, 255, 258, 260, 261, 261, law enforcement agencies................................................... 116, 176, 366, 368, 518 law enforcement analysis.................................................................................. 489 law enforcement as a means to end conflict........................................ 107, 108, 111 law enforcement community......................................................................175, 201 law enforcement professionals............................................................................ 97

Subject Index

553

Lebanon............................................................................... 40, 111, 165, 180, 230 Library of Congress, Federal Research Division................................................ 149 linear discriminant analysis .............................................................................. 461 logistic regression .............................................................. 204, 451, 461, 467, 469 Lords Resistance Army .................................................................................... 126 low ranking socio-economic status ................................................................... 104 low-ranking political status............................................................................... 104 LR ...................................................................................... See Logistic regression -Mmachine learning algorithms.......................................................409, 411, 415, 453 machine learning methodologies.................................................210, 367, 381, 408 machine learning techniques......................................................................409, 410 macroeconomic stability................................................................................... 136 malicious insider ........................................................ 407, 408, 409, 410, 412, 413 media......................................................59, 77, 85, 88, 92, 94, 115, 118, 120, 122, 125, 131, 144, 146, 164, 173, 222, 240, 272, 278, 279, 519, media exposure .................................................................................................. 76 media organizations ....................................................................................12, 519 media richness ..........................................................................................246, 247 Medical Subject Headings (MeSH)............................. 386, 388, 390, 391, 392, 394 Memorial Institute for the Prevention of Terrorism ............. 141, 147, 148, 149, 150 MEMRI .................................................See Middle East Media Research Institute methodological grounds .....................................See Terrorism studies methologies Middle East Media Research Institute................................................ 240, 244, 270 Middle Eastern countries ...........................................................................239, 262 Middle Eastern extremist organizations .............................. 238, 243, 245, 254, 262 militant religious fundamentalists ..................................................................... 110 military expenditure ......................................................................................... 117 MIPT .................................. See Memorial Institute for the Prevention of Terrorism modus operandi (of terrorist groups).....102, 159, 267, 272, 273, 274, 276, 278, 280 Moro tribe.......................................................................................................... 44 mortars............................................................................................................. 185 multiple frame features..............................................................................503, 508 Muslim Brotherhood ........................................................................................ 110 -Nnamed entities ............................................................ 122, 314, 329, 410, 414, 416 National Counterterrorism Center ...................................................... 145, 147, 152 National Security Agency...........................................................198, 200, 202, 210 Natural Language Processing .. 6, 292, 407, 408, 409, 410, 411, 414, 415, 418, 419, 420, 528 network topology ............................................................................................. 478 networked organizational structure of terrorist groups ....................................... 143 Nexis ........................................................................................................118, 148 Nigeria............................................................................................................. 137 Nixon Center Jihadi database............................................................................ 152

554

Subject Index

NLP ......................................................................See Natural language processing node clustering algorithm ................................................................................. 226 nonrandom networks ........................................................................................ 479 nonstate terrorism............................................................................................... 54 non-state terrorist groups .................................................................................. 143 North Korea ...............................................................................412, 414, 417, 418 Northern Ireland................................................................................................. 76 NSA............................................................... See National Security Agency (U.S.) -OOCLC .............................................................................................................. 148 one-class SVM................................................................... 411, 414, 418, 419, 420 open source...................................................................................................... 148 optimal decision boundary..........................................................457, 458, 459, 461 optimal set .......................................................... 320, 332, 334, 336, 337, 339, 341 organizational aspects of terrorism.................................................................... 143 organizational communication.......................................................................... 183 organizational learning ....................................... 175, 176, 177, 178, 180, 182, 185, 187, 188, 195, 196, 268, 269, 281 organization-specific indicators ........................................................................ 160 -PPalestine ........................................................................................... 110, 112, 138 Palestinian Authority........................................................................................ 111 Palestinian insurgents....................................................................................... 106 PartialMatch.................. 322, 323, 324, 330, 331, 333, 335, 337, 338, 341, 343, 346 patterns of global terrorism............................................................................... 148 performance metrics...................................................................325, 331, 343, 462 Philippines ......................................................................................................... 44 physical abuse.................................................................................................. 104 political repression ........................................................................................... 104 political violence......................................................................4, 9, 15, 74, 81, 104 poverty............................................................................................................. 104 pre-conflict information.................................................................................... 116 Press Freedom.................................................................................................. 136 primary sources for terrorism studies .................................................................. 75 privacy concerns ........................................................ 201, 206, 210, 348, 522, 523 privacy protection ........................ 200, 207, 209, 210, 214, 347, 349, 359, 360, 361 problem of specificity....................................................................................... 105 Provisional IRA ................................................................................................. 79 proximate conflict indicators ............................................................................ 117 psychological warfare....................................................................................... 173 public arbitration.............................................................................................. 136 public health ..................................................................................... 385, 387, 404 -Qquality-of-life measures.................................................................................... 103

Subject Index

555

quantitative conflict indicators.......................................................................... 118 queue size .......................................................................... 374, 378, 379, 380, 381 -Rracial terms ..................................................................................................... 295 RAND Corporation ............................................................................. 54, 148, 149 RAND Terrorism Chronology .......................................................................... 149 RAND-MIPT Incident Database....................................................................... 149 recruitment................................................. 102, 105, 111, 161, 176, 189, 196, 233, 238, 240, 267, 280, 287, 366, 473, 474, 475, 494, regional instability............................................................................................ 136 rejection of state authority ................................................................................ 136 relation classes .................................................................................. 318, 319, 328 relation extraction . 309, 312, 313, 314, 319, 320, 321, 325, 326, 329, 341, 343, 344 relation instances...309, 310, 311, 312, 313, 315, 317, 318, 319, 320, 321, 322, 323, 324, 326, 328, 329, 330, 331, 332, 343 relative deprivation theory................................................................................ 104 religious and cultural rights .............................................................................. 136 religious ideology............................................................................................. 160 religious terrorism .............................................................................................. 54 retired terrorists.................................................................................................. 77 Revolutionary Armed Forces of Colombia (FARC) .......................... 111, 180, 239, risk analysis ..................................................................................................... 158 root cause of conflict ........................................... 115, 117, 122, 124, 131, 134, 135 root causes of terrorism .................................................................................... 101 Russia .......................................................................................................110, 269 Russian suicide plane bombings ....................................................................... 145 Rwanda.....................................................................................................126, 137 -Sscale-free networks............................................................................ 478, 479, 486 scenario building for threat assessment ......................................................159, 164 search engines.................................................... 147, 223, 226, 273, 316, 326, 478 seed URL............................................................ 224, 226, 228, 241, 242, 244, 273 semantic content................................................................ 119, 272, 280, 412, 413, semantic spaces.................................................................. 116, 119, 120, 122, 433 sentiment analysis ............................................................................. 286, 288, 291 separatists .................................................................................................110, 243 September 11 attacks..................................................................... See 9/11 attacks Serbia .............................................................................................................. 110 Shining Path (Peru) .......................................................................................... 239 shooting attacks................................................................................................ 167 shortest path length ...................................................................................481, 486 single frame features ..................................................................503, 504, 506, 508 single slot extraction......................................................................................... 315 singular value decomposition .............................. 119, 347, 349, 350, 353, 358, 361 Sinn Fein .......................................................................................... 76, 79, 80, 81

556

Subject Index

situational awareness.................................. 517, 518, 522, 523, 524, 525, 527, 531, 532, 539, 540, 541, 542 situational information ................. 517, 518, 523, 525, 526, 531, 534, 539, 541, 544 small-world network ......................................................................... 478, 479, 486 smallpox vaccine.............................................................................................. 397 social network analysis........................... ...... ... 6, 11, 212, 240, 272, 287, 349, 454, 473, 474, 475, 479, 480, 487, 493 social network analysis....................................................... 473, 475, 479, 480, 493 social network theory ....................................................................................... 102 social networks ................................................................................. 3, 4, 5, 6, 479 social sciences............................................................................. 38, 104, 142, 145 social structure ................................................................................................. 479 Soviets ............................................................................................................. 178 Sparsified Single Value Decomposition ............. See Singular Value Decomposition splinter groups ................................................................................................. 143 Sri Lanka ........................................................................................................... 77 SSVD .................................................................. See Single Value Decomposition starvation ......................................................................................................... 104 statistical analysis.......................................... 27, 35, 37, 38, 47, 237, 262, 368, 478 statistical method for threat assessment............................................................. 158 strategic value (of terrorist target)..................................................................... 158 structural conflict indicators ............................................................................. 117 structural theories............................................................................................. 103 Studies in Conflict & Terrorism............................................................. 31, 57, 148 Sudan........................................................................................................126, 137 suicide attacks...........................................................................................160, 165 suicide bombers and bombings .................... 111, 145, 165, 166, 274, 276, 277, 326 suicide tactics..........................................................................................42, 43, 44 suicide terrorism......................................................40, 41, 42, 43, 44, 46, 102, 110 support vector machine....................................... 357, 358, 360, 407, 411, 413, 416, 418, 419, 420, 461, 467 susceptibility to radicalization .......................................................................... 104 suspected terrorists..................................................... 149, 211, 213, 365, 366, 381 SVM............................................................................See Support vector machine symbolic value (of terrorist targets) .................................................................. 158 Syria ................................................................................................................ 110 systemic conflict indicators .............................................................................. 117 -TTamil Tigers ...................................................................................................... 77 Tanzania ...................................................................................................126, 129 target word........................................................................................ 430, 431, 432 technical sophistication ...................................... 237, 238, 239, 241, 242, 243, 246, 247, 248, 249, 251, 252, 260, 262, 269 tension between groups .................................................................................... 136 Terrorism and Political Violence........................................................... 31, 57, 148 terrorism books .................................................................................................. 28

Subject Index

557

terrorism databases.....................................................................145, 146, 147, 152 terrorism journals ............................................................................................... 58 terrorism researchers .......................................... 3, 4, 5, 6, 8, 10, 11, 15, 17, 21, 30, 38, 41, 53, 54, 56, 62, 67 terrorism studies.............................................................................. 33, 52, 53, 144 terrorism studies journals.................................................................................... 28 terrorist attack cycle ......................................................................................... 102 terrorist attacks................................................. 4, 38, 41, 43, 44, 46, 143, 147, 150, 198, 199, 200, 201, 366, 493, 539 terrorist group formation .................................................................................. 101 terrorist group organization .............................................................................. 102 terrorist groups' characteristics.......................................................................... 159 terrorist insurgencies .................................................. 101, 102, 103, 105, 107, 108 terrorist life cycle ............................................................................................. 102 terrorist tactics ........................42, 43 (See also Modus operandi of terrorist groups) text categorization ......................................................................357, 409, 411, 417 text mining......................................................................... 385, 386, 474, 475, 477 textual files ...............................................................................................245, 254 threat assessment................................................. 116, 157, 158, 159, 162, 164, 172 threat assessment process ................................................................................. 158 threat context ................................................................................................... 116 topic space ................................................................................................122, 123 topical terms ............................................... 385, 386, 394, 396, 399, 401, 405, 406 topological analysis ....................................................................481, 482, 485, 486 tourist venue .................................................................................................... 172 training data .........................................119, 120, 204, 370, 410, 414, 467, 468, 469 transformational learning................................................................... 182, 183, 196 -UUganda ............................................................................................................ 126 use of statistics in terrorism studies..................................................................... 35 -VVenue-specific factors for threat assessment ..............................................159, 163 victims........................................... 14, 142, 317, 318, 328, 519, 525, 527, 528, 529 violence and hate affects............................................. 285, 286, 292, 298, 300, 301 virus and bacteria ............................................................... 385, 386, 387, 390, 394 visualization.................................... 3, 5, 6, 10, 11, 20, 21, 160, 172, 202, 231, 289, 290, 294, 302, 303, 304, 368, 473, 480, 483, 484, 487, 488, 526, 527, 534, 541 visualization technique...........................................3, 5, 6, 172, 290, 294, 304, 526 -Wwatch list ................................................................... 116, 213, 427, 429, 435, 447 weak judicial system ........................................................................................ 136 weapons of mass destruction (WMD) ............................. 42, 43, 148, 152, 414, 416 web discourse.......................................286, 288, 291, 293, 294, 295, 296, 297, 304 web interactivity...................................237, 239, 241, 242, 246, 247, 248, 261, 262

558

Subject Index

Web mining ................................. 221, 262, 266, 473, 474, 475, 477, 478, 479, 493 West Bank ................................................................................................106, 112 white supremacist.......................................................................240, 287, 288, 474 WMD Terrorism database ................................................................................ 152 word distributions ............................................................................................ 119 -ZZambia............................................................................................................. 129 Zimbabwe ........................................................................................................ 137